CVE-2026-40284 — WeGIA has stored XSS in listar_despachos.php

CVE-2026-40284

WeGIA has stored XSS in listar_despachos.php PUBLISHED

Description (CNA)

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field. The payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.

Affected (CNA)

Vendor / product	Versions
LabRedesCefetRJ / WeGIA	affected < 3.6.10

CWE

CWE-79

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mccp-8446-phw5

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.