PT-2026-3306 · Wegia · Wegia

Marcostolosa · Publicado 2026-01-16 · Atualizado 2026-01-17 · CVE-2026-23722

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.2

Description WeGIA is a Web Manager for Charitable Institutions. A Reflected Cross-Site Scripting (XSS) issue exists within the system, specifically in the html/memorando/insere despacho.php file. The application does not properly sanitize or encode user input provided through the id memorando GET parameter before including it in the HTML output. This allows attackers to inject arbitrary JavaScript or HTML into a user's browser session. The vulnerability allows for unauthorized JavaScript injections and potential session hijacking. The vulnerable parameter is id memorando within the ''insere despacho.php'' file.

Recommendations Versions prior to 3.6.2 should be updated to version 3.6.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-23722

GHSA-G7HH-6QJ7-MCQF

Produtos afetados

Wegia

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23722.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7hh-6qj7-mcqf · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012303195582906845 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2012263461774880887 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2012315049512087927 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2012248766632313124 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2012264543184208012 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23722 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23722 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2012533811771572646 · Publicação no Twitter