CVE-2026-61719：WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historico_prontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through POST /controle/control.php with nomeClasse=SaudeControle, metodo=alterarProntuario, and id_fichamedica. The stored content is rendered when another user accesses /html/saude/historico_prontuarios.php with id_historico, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.

漏洞详情

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historico_prontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through POST /controle/control.php with nomeClasse=SaudeControle, metodo=alterarProntuario, and id_fichamedica. The stored content is rendered when another user accesses /html/saude/historico_prontuarios.php with id_historico, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.

风险评估

• CVSS 评分：8.9（HIGH）
• 评分版本：CVSS 3.1
• 攻击向量：CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

弱点类型

CWE-79

参考链接

• https://github.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d
• https://github.com/LabRedesCefetRJ/WeGIA/issues/1704
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974

数据来源：NVD（美国国家漏洞数据库），入库时按 CVSS 评分筛选。

原文链接： CVE-2026-61719：WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a