GHSA-83p7-cx5x-7g34: WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

Published Oct 29, 2026

Updated

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listardespachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and web/dao/memorando/DespachoDAO.php: FILTERSANITIZESPECIALCHARS is applied during storage, but htmlentitydecode() later decodes the stored content and jQuery .html() inserts the result into the DOM. An attacker able to submit a memorandum dispatch through /controle/control.php using DespachoControle and metodo=incluir can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through /html/memorando/listardespachos.php with idmemorando. This permits arbitrary JavaScript execution, theft of administrator PHPSESSID session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WeGIA to a version that resolves this vulnerability.
Fixed in 3.8.7

Event History

Oct 29, 2026

CVE Published

via OSV·09:22 PM

Data Sourced

via OSV·09:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

WeGIA versions prior to 3.8.7 are affected. The issue is in the memorandum dispatch flow and is triggered when a user views a memorandum thread containing attacker-controlled dispatch text.

What access does an attacker need to exploit this?

An attacker needs an account or other ability to submit a memorandum dispatch through /controle/control.php using DespachoControle with metodo=incluir. They must also cause another user to view the affected memorandum thread.

Are users affected merely by viewing malicious content?

Yes. The stored payload executes automatically when a user opens listar_despachos.php for the affected memorandum thread; no additional interaction is described.

What is the impact if a privileged user views a malicious dispatch?

The attacker can execute arbitrary JavaScript in that user's browser and steal administrator PHPSESSID session tokens. This can enable privileged session hijacking, account takeover, and access to privileged or internal functionality.

What should be done if the instance cannot be upgraded immediately?

The provided data identifies the vulnerable path as dispatch text stored through DespachoControle and rendered in listar_despachos.php. Restricting untrusted users' ability to submit memorandum dispatches would reduce exposure until upgrading to 3.8.7.

GHSA-83p7-cx5x-7g34: WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this?

Are users affected merely by viewing malicious content?

What is the impact if a privileged user views a malicious dispatch?

What should be done if the instance cannot be upgraded immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this?

Are users affected merely by viewing malicious content?

What is the impact if a privileged user views a malicious dispatch?

What should be done if the instance cannot be upgraded immediately?