CVE-2026-61673

Deferred Deferred - Pending Action

Stored DOM XSS in WeGIA Web Manager Prior to 3.8.7

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: GitHub, Inc.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-61673

EUVD

EUVD-2026-113398

Affected Vendors & Products

Vendor	Product	Version / Range
LabRedesCefetRJ	WeGIA	< 3.8.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored DOM-based cross-site scripting (XSS) vulnerability in WeGIA, a web manager for charitable institutions. It occurs due to unsafe handling of the 'texto' field in memorandum dispatches. The vulnerability arises when malicious HTML or JavaScript is stored via a specific endpoint and later rendered unsafely in the DOM, allowing arbitrary code execution when viewed by other users.

Detection Guidance

Check WeGIA version for 3.8.7 or higher. Inspect memorandum dispatch entries in /html/memorando/listar_despachos.php for stored HTML/JS in the texto field. Look for suspicious JavaScript execution when viewing memoranda.

Impact Analysis

An attacker could exploit this to steal administrator session tokens (PHPSESSID), hijack privileged sessions, take over accounts, or gain unauthorized access to internal functions. Users viewing affected memorandum threads could unknowingly execute malicious scripts, leading to data theft or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or theft, violating GDPR's data protection requirements and HIPAA's safeguards for sensitive health information. Compliance failures may result in legal penalties, reputational damage, and loss of trust due to potential breaches of confidentiality and integrity.

Mitigation Strategies

Upgrade WeGIA to version 3.8.7 or later. Review and sanitize stored memorandum content. Implement strict input validation for the texto field. Monitor for unauthorized access or script execution.

Hi! I’m here to help you understand CVE-2026-61673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70