{"id":"CVE-2026-61673","state":"PUBLISHED","title":"WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover","description":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.","publishedAt":"2026-10-29T21:22:22.290Z","updatedAt":"2026-10-29T21:22:22.290Z","severity":{"score":6.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["LabRedesCefetRJ WeGIA"],"affected":[{"vendor":"LabRedesCefetRJ","product":"WeGIA","versions":[{"version":"< 3.8.7","status":"affected"}]}],"references":["https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34","https://github.com/LabRedesCefetRJ/WeGIA/issues/516","https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af","https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T23:14:04.755Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/61xxx/CVE-2026-61673.json","commit":"dc7676b3f67d6707e4927968546e7e0125ff7ec7","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-61673","state":"PUBLISHED","datePublished":"2026-10-29T21:22:22.290Z","dateUpdated":"2026-10-29T21:22:22.290Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-07-10T18:25:21.468Z"},"containers":{"cna":{"title":"WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover","descriptions":[{"lang":"en","value":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7."}],"affected":[{"vendor":"LabRedesCefetRJ","product":"WeGIA","versions":[{"version":"< 3.8.7","status":"affected"}]}],"references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34","name":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/516","name":"https://github.com/LabRedesCefetRJ/WeGIA/issues/516","tags":["x_refsource_MISC"]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af","name":"https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af","tags":["x_refsource_MISC"]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","name":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-29T21:22:22.290Z"},"source":{"advisory":"GHSA-83p7-cx5x-7g34","discovery":"UNKNOWN"}}}}}