CVE-2026-23725

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2026-23725
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23725.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23725
Aliases
  • GHSA-c85q-4fwg-99gw
Published
2026-01-16T19:38:27Z
Modified
2026-01-18T03:41:10.768855Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page
Details

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/cadastroadotante.php and html/pet/adotantes/informacaoadotantes.php endpoint of the WeGIA application. The application does not sanitize user-controlled input before rendering it inside the Adopters Information table, allowing persistent JavaScript injection. Any user who visits the page will have the payload executed automatically. This vulnerability is fixed in 3.6.2.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23725.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/labredescefetrj/wegia

Affected ranges

Type
GIT
Repo
https://github.com/labredescefetrj/wegia
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
650e84448985b3fb44276b6def5544bd9478ee45

Affected versions

0.*

0.9.4-beta

3.*

3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.6.0
3.6.1

v1.*

v1.0

v2.*

v2.0
v2.0-beta

v3.*

v3.0
v3.1
v3.2.0
v3.2.10
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.17
v3.2.6
v3.2.7
v3.2.8
v3.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23725.json"