CVE-2026-40284: WeGIA has stored XSS in listar_despachos.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field. The payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40284?
CVE-2026-40284 has a medium severity level due to its potential impact through stored XSS exploits.
How do I fix CVE-2026-40284?
To fix CVE-2026-40284, update WeGIA to version 3.6.10 or later, which addresses this vulnerability.
What type of attack does CVE-2026-40284 enable?
CVE-2026-40284 enables a Stored Cross-Site Scripting (XSS) attack allowing attackers to inject malicious scripts.
Who is affected by CVE-2026-40284?
CVE-2026-40284 affects authenticated users of WeGIA versions prior to 3.6.10.
In which part of WeGIA is CVE-2026-40284 found?
CVE-2026-40284 is found in the listar_despachos.php file within the WeGIA application.