WeGIA: Stored cross-site scripting in patient record history page
Summary
WeGIA, a web manager for charitable institutions, contains a stored cross-site scripting flaw in the textoProntuario field of the medical record history page (saude/historico_prontuarios.php). An attacker who can create or access a patient's medical record can store JavaScript that runs in the browser of another user who opens the affected history page. Successful exploitation can lead to session cookie theft and possible account compromise, depending on the victim's privileges.
Affected
- WeGIA versions before 3.8.7
- Some sources state up to 3.8.6; the vendor advisory is the authority on the affected range
Fixed in
- Upgrade to WeGIA 3.8.7 or later
Workaround
- No vendor-documented workaround.
- Limit who can create, edit or view patient medical records.
- Review existing textoProntuario entries for script or HTML content.
- Enforce a strict Content-Security-Policy where feasible. These measures reduce risk but do not replace the patch.
Exploitation
- Not known to be exploited at the time of writing.
- Not listed in CISA KEV; no public exploit code confirmed.
- Attacker requires a low-privilege account and a victim who opens the affected page (user interaction required).
Our recommendation
- If WeGIA is in use, upgrade to version 3.8.7 or later as a priority.
- Check the installed version and identify any instance running 3.8.6 or older.
- Restrict access to medical record functions to required staff only.
- Review stored record content for suspicious script or HTML.
- Monitor for unusual session activity and review logs for abuse of the record functions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qm7p-cprp-f974 github.com
- WeGIA release 3.8.7 github.com
- Fixing commit 52eeca6 github.com
- WeGIA issue #1704 github.com
- VulDB CVE-2026-61719 vuldb.com
- CVSS details CVE-2026-61719 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:25.
Original description (NVD)
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.