CVE-2026-40286: WeGIA has Cross-Site Scripting in Controle de Contribuição
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the 'Member Registration' (Cadastrar Sócio) function. By injecting a payload into the 'Member Name' (Nome Sócio) field, the script is persistently stored in the database. Consequently, the payload is executed whenever a user navigates to certain URL. Version 3.6.10 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40286?
CVE-2026-40286 is classified as a medium severity vulnerability due to the potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2026-40286?
To fix CVE-2026-40286, upgrade WeGIA to version 3.6.10 or later as this version addresses the XSS vulnerability.
What impact does CVE-2026-40286 have on users?
CVE-2026-40286 allows attackers to inject malicious scripts into the Member Registration function, potentially compromising user data.
In which versions is CVE-2026-40286 present?
CVE-2026-40286 is present in all versions of WeGIA prior to 3.6.10.
Is CVE-2026-40286 a widely exploited vulnerability?
As of now, there are no reports of active exploitation specifically for CVE-2026-40286, but it poses a significant risk due to its nature.