CVEsLabRedesCefetRJCVE-2026-61719Published Oct 29, 21:26 · Updated Oct 29, 21:26 UTC
8.9
HighCVSS 3.1 · from GitHub_M
CVE-2026-61719

WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field

WeGIA · Cross-site scripting · CWE-79
AffectedWeGIA
FixNo fix listed yet.
PublishedOct 29, 21:26 · GitHub_M
ScoredOct 29 · 8.9 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC

What we know

No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed inWeGIA< 3.8.7–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974 · github.comrefsource_CONFIRMgithub.com/LabRedesCefetRJ/WeGIA/issues/1704 · github.comrefsource_MISCgithub.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d · github.comrefsource_MISCgithub.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7 · github.comrefsource_MISC

Other CVEs in WeGIA

All 189 →
6.3WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover · CVE-2026-61673Oct 298.1WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes · CVE-2026-61671Oct 299.8WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php · CVE-2026-55684Oct 14