---
id: CVE-2026-61673
title: 'WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover'
summary: >-
  WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored
  DOM cross-site scripting vulnerability in
  `web/html/memorando/listar_despachos.php` results from unsafe handling of the
  `texto` field. The affected flow spans `…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: LabRedesCefetRJ
product: WeGIA
affected:
  - WeGIA < 3.8.7
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T01:49:50.016321Z'
exploitAvailable: true
published: '2026-10-29'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T01:50:23.862Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61673'
references:
  - url: >-
      https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34
    label: >-
      https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34
  - url: 'https://github.com/LabRedesCefetRJ/WeGIA/issues/516'
    label: 'https://github.com/LabRedesCefetRJ/WeGIA/issues/516'
  - url: >-
      https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af
    label: >-
      https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af
  - url: 'https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7'
    label: 'https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7'
tags:
  - cve.org
  - exploit-available
epss: 0.00334
epssPercentile: 0.26948
ingestedAt: '2026-11-03T09:40:52.159Z'
---

## Overview

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.

## Affected

- `WeGIA < 3.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.