Stored DOM Cross-Site Scripting in WeGIA Web Manager for Charitable Institutions

CVE-2026-61673

What is CVE-2026-61673?

A stored DOM cross-site scripting vulnerability exists within WeGIA, a web management application for charitable institutions. The flaw arises from improper handling of the texto field in web/html/memorando/listar_despachos.php, where sensitive data is improperly sanitized before being stored. This issue allows an attacker to store malicious HTML or JavaScript that executes automatically when viewed by other users. The vulnerability affects the flow through web/controle/memorando/DespachoControle.php and web/dao/memorando/DespachoDAO.php, compromising authentication tokens and potentially granting unauthorized access to system functions. The issue has been resolved in version 3.8.7.

References