PT-2026-30736 · Wegia · Wegia

Dapickle · CVE-2026-35399 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.9

Description WeGIA, a Web manager for charitable institutions, is affected by a stored cross-site scripting (XSS) issue. An attacker can inject malicious scripts through a backup filename. Successful exploitation could lead to unauthorized execution of malicious code in the victim’s browser, potentially compromising session data or enabling actions on behalf of the user.

Recommendations Update to version 3.6.9 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35399

GHSA-FMWV-62WF-2HGX

Affected Products

Wegia

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35399.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fmwv-62wf-2hgx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35399 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35399 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2041283941106106822 · Twitter Post
• https://twitter.com/CVEnew/status/2041282889388835240 · Twitter Post