VYPR
← All advisories
Medium severity5.4OSV Advisory· Published Jan 16, 2026· Updated Jun 17, 2026

CVE-2026-23725

CVE-2026-23725

Description

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/cadastro_adotante.php and html/pet/adotantes/informacao_adotantes.php endpoint of the WeGIA application. The application does not sanitize user-controlled input before rendering it inside the Adopters Information table, allowing persistent JavaScript injection. Any user who visits the page will have the payload executed automatically. This vulnerability is fixed in 3.6.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • LabRedesCefetRJ/WegiaOSV
    Range: 0.9.4-beta, 3.3.0, 3.3.1, …
  • Wegia/Wegia2 versions
    cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*range: <3.6.2
    • (no CPE)range: <3.6.2

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.