CVE-2026-42872

{
  "id": "CVE-2026-42872",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T20:25:43.690",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to improper handling of user-supplied input. The id_processo parameter is directly embedded into the HTML without sanitization, allowing attackers to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or execution of malicious actions in the context of the victim's browser. This vulnerability is fixed in 3.7.0."
    },
    {
      "lang": "es",
      "value": "WeGIA es un gestor web para instituciones benéficas. En versiones anteriores a la 3.7.0, existe una vulnerabilidad de cross-site scripting (XSS) reflejado en lista_arquivos_etapa.php debido a un manejo inadecuado de la entrada proporcionada por el usuario. El parámetro id_processo se incrusta directamente en el HTML sin sanitización, permitiendo a los atacantes inyectar JavaScript arbitrario. Esto puede llevar a secuestro de sesión, robo de credenciales o ejecución de acciones maliciosas en el contexto del navegador de la víctima. Esta vulnerabilidad se corrige en la 3.7.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "LabRedesCefetRJ",
          "product": "WeGIA",
          "versions": [
            {
              "version": "< 3.7.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T19:43:26.352030Z",
          "id": "CVE-2026-42872",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gp6v-f6q5-wq62",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gp6v-f6q5-wq62",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}