PT-2026-3309 · Wegia · Wegia

Volksec · Publicado 2026-01-16 · Atualizado 2026-01-17 · CVE-2026-23725

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.2

Description WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) issue exists in the application due to a failure to sanitize user-controlled input before rendering it. This allows for persistent JavaScript injection within the Adopters Information table. Visiting the affected page will automatically execute the injected payload. The vulnerable API endpoints are /html/pet/adotantes/cadastro adotante.php and /html/pet/adotantes/informacao adotantes.php.

Recommendations Update to version 3.6.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-23725

GHSA-C85Q-4FWG-99GW

Produtos afetados

Wegia

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23725.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2 · Nota
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-c85q-4fwg-99gw · Aviso do Fabricante
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1333 · Correção
• https://twitter.com/CVEnew/status/2012303193527697680 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2012322729379152250 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23725 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23725 · Nota de Segurança