PT-2026-3309 · Wegia · Wegia

Volksec · Published 2026-01-16 · Updated 2026-01-17 · CVE-2026-23725

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.2

Description WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) issue exists in the application due to a failure to sanitize user-controlled input before rendering it. This allows for persistent JavaScript injection within the Adopters Information table. Visiting the affected page will automatically execute the injected payload. The vulnerable API endpoints are /html/pet/adotantes/cadastro adotante.php and /html/pet/adotantes/informacao adotantes.php.

Recommendations Update to version 3.6.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23725

GHSA-C85Q-4FWG-99GW

Affected Products

Wegia

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23725.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-c85q-4fwg-99gw · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1333 · Patch
• https://osv.dev/vulnerability/CVE-2026-23725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23725 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2 · Note
• https://twitter.com/CVEnew/status/2012303193527697680 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012322729379152250 · Twitter Post