CVE-2026-23722

WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7hh-6qj7-mcqf	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:21

Type	Values Removed	Values Added
Summary		(es) WeGIA es un Gestor Web para Instituciones Benéficas. Antes de 3.6.2, se descubrió una vulnerabilidad de cross-site scripting (XSS) reflejado en el sistema WeGIA, específicamente dentro del archivo html/memorando/insere_despacho.PHP. La aplicación no logra sanear o codificar correctamente la entrada proporcionada por el usuario a través del parámetro GET id_memorando antes de reflejarla en el código fuente HTML (probablemente dentro de un bloque

30 Jan 2026, 18:27

Type	Values Removed	Values Added
First Time		Wegia wegia Wegia
CPE		cpe:2.3:a:wegia:wegia::::::::
References	~~() https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7hh-6qj7-mcqf -~~	() https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7hh-6qj7-mcqf - Exploit, Mitigation, Vendor Advisory

16 Jan 2026, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-16 20:15

Updated : 2026-06-17 10:21

NVD link : CVE-2026-23722

Mitre link : CVE-2026-23722

CVE.ORG link : CVE-2026-23722

JSON object : View

Products Affected

wegia

wegia

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-23722", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23722", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T21:35:21.808549Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "LabRedesCefetRJ", "product": "WeGIA", "versions": [{"status": "affected", "version": "< 3.6.2"}]}]}], "published": "2026-01-16T20:15:50.017", "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7hh-6qj7-mcqf", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2."}, {"lang": "es", "value": "WeGIA es un Gestor Web para Instituciones Ben\u00e9ficas. Antes de 3.6.2, se descubri\u00f3 una vulnerabilidad de cross-site scripting (XSS) reflejado en el sistema WeGIA, espec\u00edficamente dentro del archivo html/memorando/insere_despacho.PHP. La aplicaci\u00f3n no logra sanear o codificar correctamente la entrada proporcionada por el usuario a trav\u00e9s del par\u00e1metro GET id_memorando antes de reflejarla en el c\u00f3digo fuente HTML (probablemente dentro de un bloque "}], "lastModified": "2026-06-17T10:21:59.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "419B3A85-5754-4198-A73E-92A9DA8E7A68", "versionEndExcluding": "3.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}