Thiagoescarrone

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa processo.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo aceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.6.10 **Description** WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) issue allows an authenticated user to inject malicious JavaScript through the `Nome` field on the 'Informações Pacientes' page. The payload is stored and executed when patient information is viewed. **Recommendations** Update to version 3.6.10.