CVE-2026-61673 Details
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.
A stored DOM cross-site scripting vulnerability has been identified in WeGIA, a web management application for charitable institutions, in versions prior to 3.8.7. The issue arises from improper handling of the 'texto' field in 'web/html/memorando/listar_despachos.php'. Although the application sanitizes the input during storage, it later decodes the HTML entities and inserts the content into the DOM using jQuery, allowing for the execution of arbitrary JavaScript. This vulnerability can be exploited by an attacker to steal administrator session tokens, hijack privileged accounts, and gain unauthorized access to internal functionalities.
Users can update to WeGIA version 3.8.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af | [email protected] | Source CodeVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/issues/516 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7 | [email protected] | Release NotesVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeGIA | <= 3.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |