PT-2026-33512 · Wegia · Wegia

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40284

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.10

Description An authenticated user can inject malicious JavaScript through the 'Destinatário' field. This stored script executes when other users view the dispatch page. Cross-Site Scripting (XSS) is a flaw that allows attackers to execute scripts in the victim's browser.

Recommendations Update to version 3.6.10.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40284

Affected Products

Wegia

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40284 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mccp-8446-phw5 · Note
• https://twitter.com/CVEnew/status/2045467406772875634 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045288743624454371 · Twitter Post