PT-2026-39735 · Wegia · Wegia

Arthurvel · CVE-2026-42870 · Published 2026-05-11 · Updated 2026-05-11

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.7.0

Description A Stored Cross-Site Scripting (XSS) flaw exists, which allows a malicious script to be persistently stored on the server. This occurs at the 'funcionario/profile funcionario.php?id funcionario=2' endpoint when a payload is injected into the Description field and the profile is saved. The script executes automatically whenever the profile page is accessed.

Recommendations Update to version 3.7.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42870

GHSA-Q6JG-HFQV-882F

Affected Products

Wegia

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42870.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-q6jg-hfqv-882f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42870 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42870 · Vendor Advisory