CVE-2026-61719

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.7

Description A stored cross-site scripting issue exists in saude/historico prontuarios.php because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker can submit malicious content via the POST /controle/control.php endpoint using the parameters nomeClasse=SaudeControle, metodo=alterarProntuario, and id fichamedica. The content is executed in the browser of another user when they access the /html/saude/historico prontuarios.php endpoint with the id historico parameter. This can lead to session cookie theft and account compromise based on the victim's privileges.

Recommendations Update to version 3.8.7.