Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-40286: WeGIA runs scripts from malicious member names
CVE-2026-40286 · published 6 months ago
Summary
Versions of WeGIA before 3.6.10 let an attacker store harmful code in the Member Name field during registration. That code is saved in the database and runs whenever someone opens certain pages, potentially stealing data or hijacking user sessions. Updating to version 3.6.10 removes the flaw.
Original advisory text
WeGIA has Cross-Site Scripting in Controle de Contribuição
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the 'Member Registration' (Cadastrar Sócio) function. By injecting a payload into the 'Member Name' (Nome Sócio) field, the script is persistently stored in the database. Consequently, the payload is executed whenever a user navigates to certain URL. Version 3.6.10 fixes the issue.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Apr 2026
Updated29 Oct 2026
First seen17 Apr 2026
Track software like this
Free during beta