Stored Cross-Site Scripting Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-61719

What is CVE-2026-61719?

The WeGIA web management system for charitable institutions is susceptible to a stored cross-site scripting vulnerability found in the saude/historico_prontuarios.php file. This vulnerability allows an attacker to exploit the textoProntuario field, which lacks proper input sanitization. By exploiting this flaw, an attacker who has access to a patient's medical record can inject arbitrary HTML or JavaScript code through a structured POST request. Once the malicious content is stored, it is executed within the browser of any user accessing the history page, potentially leading to session cookie theft and unauthorized access, depending on user privileges. This security issue has been addressed and resolved in WeGIA version 3.8.7.

References