Executive brief
WeGIA is a web-based management platform designed for charitable institutions. A security flaw in the software allows an authorized user to plant malicious code within the 'Processo de Aceitação' (Acceptance Process) page. If another user views this page, the malicious code could steal their login session or take over their account, potentially compromising sensitive institutional data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in WeGIA versions prior to 3.7.3 within the 'Processo de Aceitação' component (html/atendido/processo_aceitacao.php). The application fails to properly sanitize or encode user-controlled input in the description field when creating or modifying a process. An authenticated attacker with high privileges can inject a malicious payload (e.g., via an img tag with an onerror attribute) that executes arbitrary JavaScript in the context of any user who subsequently views the page. This can lead to session cookie theft, unauthorized actions on behalf of other users, and full account takeover. The issue is resolved in version 3.7.3.
Affected products
- LabRedesCefetRJ WeGIA < 3.7.3
Timeline
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 3.7.3