PT-2026-3306 · Wegia · Wegia

Marcostolosa · Published 2026-01-16 · Updated 2026-01-17 · CVE-2026-23722

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.2

Description WeGIA is a Web Manager for Charitable Institutions. A Reflected Cross-Site Scripting (XSS) issue exists within the system, specifically in the html/memorando/insere despacho.php file. The application does not properly sanitize or encode user input provided through the id memorando GET parameter before including it in the HTML output. This allows attackers to inject arbitrary JavaScript or HTML into a user's browser session. The vulnerability allows for unauthorized JavaScript injections and potential session hijacking. The vulnerable parameter is id memorando within the ''insere despacho.php'' file.

Recommendations Versions prior to 3.6.2 should be updated to version 3.6.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23722

GHSA-G7HH-6QJ7-MCQF

Affected Products

Wegia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23722.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7hh-6qj7-mcqf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23722 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23722 · Vendor Advisory
• https://twitter.com/CVEnew/status/2012303195582906845 · Twitter Post
• https://twitter.com/CveFindCom/status/2012263461774880887 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012315049512087927 · Twitter Post
• https://twitter.com/0dayPublishing/status/2012248766632313124 · Twitter Post
• https://twitter.com/TheHackerWire/status/2012264543184208012 · Twitter Post
• https://twitter.com/pulsepatchio/status/2012533811771572646 · Twitter Post