{"id":"CVE-2026-61719","title":"WeGIA: Stored Cross-Site Scripting (XSS) in \"historico_prontuarios.php\" via \"textoProntuario\" Field","summary":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without …","severity":"high","cvss":8.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","cvssSource":"cna","cwe":["CWE-79"],"vendor":"LabRedesCefetRJ","product":"WeGIA","affected":["WeGIA < 3.8.7"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T16:56:43.876080Z"},"exploitAvailable":true,"published":"2026-10-29","updated":"2026-11-03","sourceUpdated":"2026-11-03T16:57:40.959Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61719","references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974","label":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/1704","label":"https://github.com/LabRedesCefetRJ/WeGIA/issues/1704"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d","label":"https://github.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","label":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7"}],"tags":["cve.org","exploit-available"],"epss":0.00236,"epssPercentile":0.14783,"ingestedAt":"2026-11-03T09:40:52.160Z","slug":"CVE-2026-61719","body":"## Overview\n\nWeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.\n\n## Affected\n\n- `WeGIA < 3.8.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":49,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":233726,"id":"CVE-2026-61719","ts":1793910827263,"field":"exploit_available","old":"false","new":"true"}]}