CVE-2026-23725CWE-79

WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page

Medium · published January 16, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/cadastro_adotante.php and html/pet/adotantes/informacao_adotantes.php endpoint of the WeGIA application. The application does not sanitize user-controlled input before rendering it inside the Adopters Information table, allowing persistent JavaScript injection. Any user who visits the page will have the payload executed automatically. This vulnerability is fixed in 3.6.2.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-16T19:38Z
EPSS history
Timeline
  • 16 JAN 19:38Z
    WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page
    cvelistv5