WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patient information is viewed. Version 3.6.10 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x74c-gwj9-6cwr | Exploit Vendor Advisory |
Configurations
History
27 Apr 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x74c-gwj9-6cwr - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* | |
| First Time |
Wegia wegia
Wegia |
17 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-17 20:16
Updated : 2026-04-27 15:17
NVD link : CVE-2026-40283
Mitre link : CVE-2026-40283
CVE.ORG link : CVE-2026-40283
JSON object : View
Products Affected
wegia
- wegia
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')