CVE-2026-61719

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historico_prontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through POST /controle/control.php with nomeClasse=SaudeControle, metodo=alterarProntuario, and id_fichamedica. The stored content is rendered when another user accesses /html/saude/historico_prontuarios.php with id_historico, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.