CVE-2026-35399CWE-79

WeGIA has Stored XSS in backup file names

High · published April 6, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup filename. This could lead to unauthorized execution of malicious code in the victim's browser, compromising session data or executing actions on behalf of the user. This vulnerability is fixed in 3.6.9.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-06T21:06Z
EPSS history
Timeline
  • 06 APR 21:06Z
    WeGIA has Stored XSS in backup file names
    cvelistv5