WeGIA stored XSS flaw tracked as CVE-2026-61719 (CVSS 8.9)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- WeGIA
- Product
- WeGIA
- First seen
Summary
A thehackerwire.com listing describes CVE-2026-61719, a stored cross-site scripting flaw in WeGIA versions before 3.8.7. The flaw is in the textoProntuario field of saude/historico_prontuarios.php, which reportedly accepts unsanitized HTML or JavaScript.
If you use WeGIA
Upgrade WeGIA to version 3.8.7 or later.
Review stored records in the affected health-history module for injected script.
Restrict access to the module until the upgrade is applied.
Check web server logs for requests to /controle/control.php with unexpected class or method parameters.
Restrict external access to the application until the upgrade is applied.
What the sources say 2
· Mastodon: “Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `e...” Source
· Mastodon: “Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper san...” Source