CVE-2026-61673— WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

Quick assessment

Affected

LabRedesCefetRJ WeGIA

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WeGIA 是一款面向慈善机构的网页管理系统。在 3.8.7 版本之前，文件中存在存储型 DOM 跨站脚本（XSS）漏洞，该漏洞源于对字段的不安全处理。受影响的数据流涉及和：数据在存储阶段虽应用了过滤器进行清理，但随后通过对已存储内容进行了解码，并借助 jQuery 的方法将结果插入到 DOM 中。攻击者可通过接口，利用类并设置参数提交备忘录派遣内容，从而注入恶意的 HTML 或 JavaScript 代码。当其他用户通过页面，使用参数查看该备忘录线程时，注入的代码将自动执行。该漏洞可导致任

CVSS 6.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1566.002 · Spearphishing Link T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

Source: CVE Program / CVE List V5

Vulnerability Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
LabRedesCefetRJ	WeGIA	< 3.8.7	-

II. Public POCs for CVE-2026-61673

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61673

请登录查看更多情报信息。

Other References for CVE-2026-61673 (4)

https://github.com/LabRedesCefetRJ/WeGIA/issues/516 x_refsource_MISC
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7 x_refsource_MISC
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34 x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61673

Same Patch Batch · LabRedesCefetRJ · 2026-10-29 · 3 CVEs total

CVE-2026-61719	8.9 HIGH	WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuar
CVE-2026-61671	8.1 HIGH	WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

IV. Related Vulnerabilities

Same product: WeGIA

Same vendor: LabRedesCefetRJ

Same weakness: CWE-79