CVE-2026-61673

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.

• CWE-79

• https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af
• https://github.com/LabRedesCefetRJ/WeGIA/issues/516
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61667DIRAC is an interware, meaning a software framework for dist…9.9
• CVE-2026-61668DIRAC is an interware, meaning a software framework for dist…8.1
• CVE-2026-6167A vulnerability was detected in code-projects Faculty Manage…7.3
• CVE-2026-61670microsandbox is an easy, fast, local-first microVM runtime a…6.5
• CVE-2026-61671WeGIA is a web manager for charitable institutions. Prior to…8.1
• CVE-2026-61672Capsule is a multi-tenancy and policy-based framework for Ku…7.1
• CVE-2026-61674Fluent Bit is a fast and lightweight logs, metrics, and trac…9.2
• CVE-2026-6168A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. …8.8
• CVE-2026-61681Hatchet is a platform for orchestrating background tasks, AI…4.1
• CVE-2026-61682kcp is a Kubernetes-like control plane for form-factors and …9.9
• CVE-2026-61684FastGPT is a knowledge-based AI application platform. In 4.1…8.8
• CVE-2026-61685ReactPress is a publishing system for React developers. Prio…7.5