CVE-2026-61719 Details
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
A stored cross-site scripting vulnerability has been identified in WeGIA, a web management tool for charitable institutions, in versions prior to 3.8.7. The issue resides in the 'saude/historico_prontuarios.php' file, where the 'textoProntuario' field allows the input of arbitrary HTML or JavaScript without adequate sanitization. An attacker with access to a patient's medical record can exploit this by submitting a payload through a specified POST request. The injected content is then executed as JavaScript when another user views the patient history, potentially leading to session cookie theft and account compromise, depending on the user's privileges.
Users can update to WeGIA version 3.8.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d | [email protected] | Source CodeVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/issues/1704 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7 | [email protected] | Release NotesVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeGIA | <= 3.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |