CVE-2026-40284 MEDIUM

CVE-2026-40284: WeGIA has stored XSS in listar_despachos.php

Vendor Labredescefetrj

Product WeGIA

Weakness CWE-79 · XSS

Published April 17, 2026

Last update April 20, 2026

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

Description

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field. The payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.

Key dates

Disclosure timeline

April 17, 2026 CVE published

April 20, 2026 Record updated