CVE-2026-61719: WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through POST /controle/control.php with nomeClasse=SaudeControle, metodo=alterarProntuario, and idfichamedica. The stored content is rendered when another user accesses /html/saude/historicoprontuarios.php with idhistorico, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
Frequently Asked Questions
Which deployments are affected?
WeGIA versions prior to 3.8.7 are affected. Version 3.8.7 contains the fix.
What access does an attacker need to exploit this issue?
The attacker must be able to create or access a patient's medical record and submit a POST request to the medical-record update function with a chosen textoProntuario value. Exploitation does not require the victim to submit the malicious content, but a victim must view the stored record.
How is the payload triggered?
The attacker-controlled content is stored in the medical record and executes automatically in the viewer's browser when they access the medical-history page with the relevant id_historico parameter. This requires victim interaction in the form of opening that record.
What is the likely impact if a privileged user views a malicious record?
The payload can steal the viewer's session cookie and may lead to account compromise, depending on that user's privileges. Because the script runs in the victim's browser, it can act within the victim's authenticated session context.