CVE-2026-45026: WeGIA: Stored XSS in html/atendido/processo_aceitacao.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processoaceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45026?
CVE-2026-45026 is considered a medium severity vulnerability due to the potential for authenticated users to inject malicious scripts.
How do I fix CVE-2026-45026?
To fix CVE-2026-45026, upgrade to WeGIA version 3.7.3 or later.
Who is affected by CVE-2026-45026?
CVE-2026-45026 affects WeGIA versions prior to 3.7.3 in the web manager for charitable institutions.
What type of vulnerability is CVE-2026-45026?
CVE-2026-45026 is a Stored Cross-Site Scripting (XSS) vulnerability.
Can CVE-2026-45026 be exploited by unauthenticated users?
No, CVE-2026-45026 can only be exploited by authenticated users.