Thiagoescarrone

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.7.3 **Description** A Stored Cross-Site Scripting (XSS) issue exists where an authenticated user can inject malicious JavaScript into the 'Etapas de um Processo' page via the endpoint 'html/atendido/etapa processo.php'. This script executes when users access the page, potentially leading to session hijacking and account takeover. Stored Cross-Site Scripting is a type of vulnerability where the malicious script is permanently stored on the target server. **Recommendations** Update to version 3.7.3.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.7.3 **Description** A Stored Cross-Site Scripting (XSS) issue allows an authenticated user to inject malicious JavaScript into the 'html/atendido/processo aceitacao.php' page. This script executes when a user accesses the page, potentially leading to session hijacking and account takeover. **Recommendations** Update to version 3.7.3.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.6.10 **Description** WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) issue allows an authenticated user to inject malicious JavaScript through the `Nome` field on the 'Informações Pacientes' page. The payload is stored and executed when patient information is viewed. **Recommendations** Update to version 3.6.10.