Browser script execution via stored employee data

Stored XSS in WeGIA before 3.2.0 allows remote attackers to execute JavaScript in users' browsers through the dados_addInfo parameter. documentos_funcionario.php stores the parameter without adequate neutralization, and profile_funcionario.php later renders it as executable script. No authentication is required to plant the payload, but a user must load the affected employee profile; the script then runs in that user's WeGIA browser context.