CVE-2026-35399: WeGIA has Stored XSS in backup file names
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup filename. This could lead to unauthorized execution of malicious code in the victim's browser, compromising session data or executing actions on behalf of the user. This vulnerability is fixed in 3.6.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35399?
CVE-2026-35399 has a severity level rated high due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2026-35399?
To fix CVE-2026-35399, upgrade WeGIA to version 3.6.9 or later where the vulnerability has been resolved.
What type of vulnerability is CVE-2026-35399?
CVE-2026-35399 is classified as a stored XSS vulnerability affecting WeGIA applications.
Who is affected by CVE-2026-35399?
Users of WeGIA versions prior to 3.6.9 are affected by CVE-2026-35399 due to the vulnerability in backup file names.
What can attackers do with CVE-2026-35399?
Attackers exploiting CVE-2026-35399 can execute malicious scripts in victims' browsers, potentially leading to unauthorized actions.