CVE-2026-61673Medium· 6.3▾ TwilightPoC availableWeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listar_despachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and web/dao/memorando/DespachoDAO.php: FILTER_SANITIZE_SPECIAL_CHARS is applied during storage, but html_entity_decode() later decodes the stored content and jQuery .html() inserts the result into the DOM. An attacker able to submit a memorandum dispatch through /controle/control.php using DespachoControle and metodo=incluir can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through /html/memorando/listar_despachos.php with id_memorando. This permits arbitrary JavaScript execution, theft of administrator PHPSESSID session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.
WeGIA < 3.8.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61719High· 8.9WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
CVE-2026-61671High· 8.1WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
CVE-2025-67496Medium· 4.3WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users
CVE-2026-55681High· 8.8WeGIA is a web manager for charitable institutions
CVE-2026-55682High· 8.1WeGIA is a web manager for charitable institutions
CVE-2026-55683Critical· 9.8WeGIA is a web manager for charitable institutions