EUVD lists CVSS 8.1 dispatch endpoint flaw in WeGIA before 3.8.7
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- LabRedesCefetRJ
- Product
- WeGIA
- First seen
Summary
The EUVD entry EUVD-2026-113397 describes an issue in WeGIA before the stated patched version 3.8.7, where the /controle/control.php dispatch endpoint accepts attacker-controlled parameters. The item gives a CVSS v3.1 score of 8.1.
If you use LabRedesCefetRJ
Upgrade WeGIA to version 3.8.7 or later
Limit access to the WeGIA web interface
Review application logs for unusual control.php requests
Review stored memorandum text for injected scripts
Review stored medical record entries for injected scripts
What the sources say 3
· Mastodon: “Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper saniti” Source
· Mastodon: “Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field.” Source
· Mastodon: “Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extr” Source