CVE-2026-23731

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-Frame-Options is missing andContent-Security-Policy with frame-ancestors directive is not configured. Because of this, an attacker can load any WeGIA page inside a malicious HTML document, overlay deceptive elements, hide real buttons, or force accidental interaction with sensitive workflows. This vulnerability is fixed in 3.6.2.

• CWE-1021

• https://github.com/LabRedesCefetRJ/WeGIA/pull/1333Issue Tracking, Patch
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2Release Notes
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-99qp-hjvh-c59qExploit, Mitigation, Vendor Advisory

Published

Jan 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23726WeGIA is a web manager for charitable institutions. Prior to…6.1
• CVE-2026-23727WeGIA is a web manager for charitable institutions. Prior to…6.1
• CVE-2026-23728WeGIA is a web manager for charitable institutions. Prior to…6.1
• CVE-2026-23729WeGIA is a web manager for charitable institutions. Prior to…6.1
• CVE-2026-2373The Royal Addons for Elementor – Addons and Templates Kit fo…5.3
• CVE-2026-23730WeGIA is a web manager for charitable institutions. Prior to…6.1
• CVE-2026-23732FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2026-23733LobeChat is an open source chat application platform. Prior …6.4
• CVE-2026-23734XWiki Platform is a generic wiki platform. Versions prior to…9.3
• CVE-2026-23735GraphQL Modules is a toolset of libraries and guidelines ded…8.7
• CVE-2026-23736seroval facilitates JS value stringification, including comp…9.8
• CVE-2026-23737seroval facilitates JS value stringification, including comp…7.5