CVE-2026-40282 in WeGIA
Summary
by MITRE • 04/18/2026
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/10/2026
The WeGIA web management platform for charitable institutions presents a critical security vulnerability through a stored cross-site scripting flaw that affects versions prior to 3.6.10. This vulnerability specifically targets the Intercorrências notification page, which serves as a critical interface for managing institutional communications and incidents. The flaw enables authenticated attackers to inject malicious JavaScript code that persists within the application's database, making it particularly dangerous as the payload executes every time a user accesses the affected page. The vulnerability stems from inadequate input validation and output encoding mechanisms within the application's data handling processes, allowing malicious payloads to bypass security controls and remain stored in the system.
The technical exploitation of this XSS vulnerability occurs through the authenticated user session, where an attacker with valid credentials can submit malicious scripts through the notification page interface. When other users subsequently access the same page, their browsers execute the stored malicious code within their browser context, creating a persistent threat vector. This stored nature of the vulnerability means that the malicious script remains active until explicitly removed from the database, potentially affecting multiple users over extended periods. The vulnerability's impact extends beyond simple script execution, as it enables session hijacking capabilities that allow attackers to impersonate legitimate users and gain unauthorized access to sensitive institutional data and administrative functions.
The operational consequences of this vulnerability are severe for charitable institutions that rely on WeGIA for their management operations. Session hijacking and account takeover capabilities provide attackers with persistent access to institutional accounts, potentially compromising sensitive donor information, financial records, and operational data. The vulnerability undermines the integrity of the entire platform, as attackers can manipulate the notification system to redirect users to malicious sites, steal session cookies, or execute additional attacks through the compromised user context. This threat is particularly concerning for charitable organizations that handle sensitive personal data and financial transactions, as the vulnerability creates opportunities for data breaches and financial fraud.
Security mitigations for this vulnerability should focus on implementing robust input validation and output encoding mechanisms throughout the application's data flow processes. The fix implemented in version 3.6.10 likely includes proper sanitization of user inputs before storage and appropriate context-aware encoding when rendering data to web pages. Organizations should also implement content security policies to prevent unauthorized script execution, employ regular security testing including automated scanning and manual penetration testing, and establish proper access controls and monitoring to detect suspicious activities. Additionally, security awareness training for administrators and users can help identify potential exploitation attempts, while maintaining up-to-date security patches and conducting regular vulnerability assessments to prevent similar issues in other components of the system. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and represents a clear violation of the principle of least privilege and secure input handling that should be enforced across all web applications. The attack vector demonstrates how authenticated users can escalate privileges through persistent script injection, making it a significant concern for any web application that processes user-generated content.