CVE-2026-40283 MEDIUM

CVE-2026-40283: WeGIA has stored XSS in profile_paciente.php

Vendor Labredescefetrj

Product WeGIA

Weakness CWE-79 · XSS

Published April 17, 2026

Last update April 20, 2026

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

Description

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patient information is viewed. Version 3.6.10 fixes the issue.

Key dates

Disclosure timeline

April 17, 2026 CVE published

April 20, 2026 Record updated