PT-2026-39736 · Wegia · Wegia

Dapickle · CVE-2026-42872 · Published 2026-05-11 · Updated 2026-05-11

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.7.0

Description A reflected Cross-Site Scripting (XSS) issue exists in the 'lista arquivos etapa.php' endpoint. The id processo parameter is embedded into the HTML without proper sanitization, allowing the injection of arbitrary JavaScript. This can result in session hijacking, credential theft, or the execution of malicious actions within the victim's browser.

Recommendations Update to version 3.7.0. As a temporary workaround, restrict access to the 'lista arquivos etapa.php' endpoint or avoid using the id processo parameter until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42872

GHSA-GP6V-F6Q5-WQ62

Affected Products

Wegia

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42872.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gp6v-f6q5-wq62 · Exploit
• https://osv.dev/vulnerability/CVE-2026-42872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42872 · Security Note
• https://twitter.com/0x2ed3bb60/status/2053935367628468412 · Twitter Post