Victim-browser script execution via unsanitized msg_c reflection

Reflected XSS in WeGIA's modulos_visiveis.php before 3.2.8 allows remote attackers to execute scripts in a victim's browser through msg_c. The endpoint reads the GET parameter without validation or sanitization and reflects its contents into the response as executable markup. No prior account is required, but successful compromise requires a victim to open an attacker-crafted request; the script then runs in that victim's WeGIA origin.