PT-2026-33511 · Labredescefetrj · Wegia

Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-40282

NVD

CVSS v4.0

6.4

Medium

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40282

Affected Products

Wegia

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40282 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r6h8-7vxv-q8pp · Note