VYPR
← All advisories
Medium severityOSV Advisory· Published Apr 17, 2026· Updated Jun 17, 2026

CVE-2026-40282

CVE-2026-40282

Description

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Wegia/WegiaOSV2 versions
    3.6.8, 3.6.9, 3.6.4, …+ 1 more
    • (no CPE)range: 3.6.8, 3.6.9, 3.6.4, …
    • (no CPE)range: <3.6.10

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.