CVE-2026-40283

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patient information is viewed. Version 3.6.10 fixes the issue.

CVSS 3.1

7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-26)

CWE

CWE-79

Published

2026-04-17

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• wegia:wegia

References

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x74c-gwj9-6cwr

Check your stackJSON