PT-2026-33502 · Wegia · Wegia

Thiagoescarrone · Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40283

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.10

Description WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) issue allows an authenticated user to inject malicious JavaScript through the Nome field on the 'Informações Pacientes' page. The payload is stored and executed when patient information is viewed.

Recommendations Update to version 3.6.10.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40283

Affected Products

Wegia

References · 4

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x74c-gwj9-6cwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40283 · Security Note
• https://twitter.com/infoflowcloud/status/2045469526397952157 · Twitter Post
• https://twitter.com/CVEnew/status/2045467412443599129 · Twitter Post