CVE-2026-45025

MEDIUM

WeGIA: Stored XSS in html/atendido/etapa_processo.php

Title source: cna
STIX 2.1

Description

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

References (1)

Core 1
Core References

Scores

CVSS v3 6.8
EPSS 0.0023
EPSS Percentile 13.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
LabRedesCefetRJ/WeGIA < 3.7.3
Published May 11, 2026
Tracked Since May 12, 2026