CVE-2026-23724
MEDIUMWeGIA <3.6.2 - XSS
Title source: llmDescription
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/atendido/cadastro_ocorrencia.php endpoint of the WeGIA application. The application does not sanitize user-controlled data before rendering it inside the “Atendido” selection dropdown. This vulnerability is fixed in 3.6.2.
Scores
CVSS v3
4.3
EPSS
0.0003
EPSS Percentile
9.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Classification
CWE
CWE-79
Status
published
Affected Products (1)
wegia/wegia
< 3.6.2
Timeline
Published
Jan 16, 2026
Tracked Since
Feb 18, 2026