Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2026-40282: WeGIA web manager lets attackers steal sessions
CVE-2026-40282 · published 6 months ago
Summary
Versions of WeGIA before 3.6.10 let a logged‑in user place harmful code on the Intercorrências notification page. When other users view that page, the code runs and can capture their login session, potentially taking over their account. Upgrade to version 3.6.10 or later to stop this behavior.
Original advisory text
WeGIA has stored XSS in intercorrencia_visualizar.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Apr 2026
Updated4 Nov 2026
First seen17 Apr 2026
Track software like this
Free during beta