Cross-site scripting in WeGIA - CVE-2026-61719
Published: July 7, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU136991
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-61719
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser.
The vulnerability exists due to cross-site scripting in saude/historico_prontuarios.php when rendering the textoProntuario field. A remote user can submit a crafted medical record entry to execute arbitrary JavaScript in another user's browser.
User interaction is required when another user views the patient history page.
Affected software
WeGIA
How to mitigate CVE-2026-61719
Install security update from vendor's website.
WeGIA - update to 3.8.7