WeGIA is a web manager for charitable organizations. The vulnerability is a stored cross‑site scripting flaw that occurs when an authenticated user submits a malicious payload through the "Destinatário" field. The input is saved and executed whenever the dispatch page is viewed, which can compromise the confidentiality, integrity, and availability of other users’ sessions by allowing an attacker to run arbitrary JavaScript in their browsers. The weakness is a classic input validation failure, classified as CWE‑79.

The affected product is WeGIA, a web management system produced by LabRedesCefetRJ. All versions prior to 3.6.10 are vulnerable; version 3.6.10 and later include the fix announced in the vendor advisory.

The CVSS score of 6.8 categorizes the flaw as moderately severe. The exploitation probability is not quantified because the EPSS score is not available, but the lack of a KEV listing suggests it is not in an active exploit catalog. The flaw can be triggered by any logged‑in user who has permission to edit the "Destinatário" field; if no additional constraints are reported, a broad set of users could be impacted. Attackers would target the dispatch page where the payload is rendered, potentially injecting session‑stealing scripts or defacing content for any user who visits that page.