Live › vulnerability › CVE-2026-61719
WeGIA, a web manager for charitable institutions, stores a patient record field without sanitizing HTML or JavaScript. When another user opens that record, the script runs in their browser and can steal session cookies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 22:27 UTC. All times on this page are UTC.
Charitable institutions running WeGIA before version 3.8.7 that let staff create or edit patient medical records. The risk is that one staff member's malicious record entry runs script in a colleague's browser when they open it, which can lead to account takeover depending on that colleague's privileges. Installations that do not use the health module or restrict who can edit records have less exposure.
No product ranges from the sources yet.
3.8.7textoProntuario field in saude/historico_prontuarios.php)3.8.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historico_prontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through POST /controle/control.php with nomeClasse=SaudeControle, metodo=alterarProntuario, and id_fichamedica. The stored content is rendered when another user accesses /html/saude/historico_prontuarios.php with id_historico, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-61719")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.