CVE-2026-42872: WeGIA: Reflected XSS in listar_arquivos_etapa.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in listaarquivosetapa.php due to improper handling of user-supplied input. The idprocesso parameter is directly embedded into the HTML without sanitization, allowing attackers to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or execution of malicious actions in the context of the victim's browser. This vulnerability is fixed in 3.7.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42872?
CVE-2026-42872 is classified as a reflected Cross-Site Scripting (XSS) vulnerability that can lead to unauthorized access and data theft.
How do I fix CVE-2026-42872?
To fix CVE-2026-42872, upgrade WeGIA to version 3.7.0 or later to ensure proper handling of user-supplied input.
Which versions of WeGIA are affected by CVE-2026-42872?
CVE-2026-42872 affects all versions of WeGIA prior to 3.7.0.
What type of vulnerability is CVE-2026-42872?
CVE-2026-42872 is a reflected Cross-Site Scripting (XSS) vulnerability.
What input is exploited in CVE-2026-42872?
CVE-2026-42872 exploits the id_processo parameter due to improper input validation.