CVE-2026-42872
Reflected XSS in WeGIA Web Manager
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wegia | wegia | 3.7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The reflected Cross-Site Scripting (XSS) vulnerability in WeGIA can lead to session hijacking, credential theft, and unauthorized actions in the victim's browser. Such security issues may result in unauthorized access to personal or sensitive data managed by the application.
Because of these risks, the vulnerability could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and secure handling of user information to prevent unauthorized access or data breaches.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the affected parameter `id_processo` in the `lista_arquivos_etapa.php` page for reflected Cross-Site Scripting (XSS). One approach is to craft a URL with a payload in the `id_processo` parameter that includes JavaScript code and observe if the script is executed or reflected in the HTML response without sanitization.
For example, you can use curl or wget to send a request with a test XSS payload and inspect the response for the injected script.
- curl -i "http://target-site/lista_arquivos_etapa.php?id_processo=<script>alert('XSS')</script>"
- wget -qO- "http://target-site/lista_arquivos_etapa.php?id_processo=<script>alert('XSS')</script>" | grep '<script>alert('XSS')</script>'
If the script tag appears in the response HTML without being escaped or sanitized, the vulnerability is present.
Can you explain this vulnerability to me?
CVE-2026-42872 is a reflected Cross-Site Scripting (XSS) vulnerability in the WeGIA software, specifically in the file lista_arquivos_etapa.php for versions prior to 3.7.0.
The vulnerability occurs because the id_processo parameter is directly embedded into an HTML hidden input field without proper sanitization or escaping.
This allows attackers to craft a malicious URL containing JavaScript code in the id_processo parameter, which executes in the victim's browser when they access the URL.
How can this vulnerability impact me? :
The reflected XSS vulnerability can lead to several security impacts including session hijacking, credential theft, phishing attacks, and unauthorized actions performed in the context of the victim's browser.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the WeGIA software to version 3.7.0 or later, where the reflected Cross-Site Scripting (XSS) issue in lista_arquivos_etapa.php has been fixed.
Until the upgrade can be applied, consider implementing input validation or sanitization on the id_processo parameter to prevent injection of malicious scripts.
Additionally, applying web application firewall (WAF) rules to detect and block suspicious input patterns targeting the id_processo parameter may help reduce risk.