CVE-2026-42870: WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' (Descrição) field and saving the profile, the script becomes persistently stored. The payload is subsequently executed whenever the profile page is accessed. This vulnerability is fixed in 3.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42870?
CVE-2026-42870 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting.
How do I fix CVE-2026-42870?
To mitigate CVE-2026-42870, upgrade WeGIA to version 3.7.0 or later where this vulnerability has been addressed.
What software is affected by CVE-2026-42870?
CVE-2026-42870 affects WeGIA versions prior to 3.7.0.
What type of vulnerability is CVE-2026-42870?
CVE-2026-42870 is a Stored Cross-Site Scripting (XSS) vulnerability.
Where is the vulnerability located in CVE-2026-42870?
The vulnerability in CVE-2026-42870 is located in the 'informacao_adicional.php' endpoint, specifically in the 'descricao' parameter.