The vulnerability is a stored cross‑site scripting flaw in the WeGIA web manager that allows an attacker to submit malicious HTML or JavaScript through the 'textoProntuario' field. When a victim later views the medical history page, the attacker‑crafted script runs in the victim’s browser, enabling session cookie theft and potentially elevating privileges depending on user rights. This issue, identified as CWE‑79, can lead to account compromise and unauthorized data access.

All installations of WeGIA older than version 3.8.7, maintained by LabRedesCefetRJ, are affected. The flaw exists in the 'saude/historico_prontuarios.php' page and the backend 'controle/control.php' handling of the 'alterarProntuario' method, allowing any user who can create or edit a patient record to inject scripts.

The CVSS score of 8.9 indicates a high severity flaw, while the EPSS score is not available; therefore the concrete likelihood of exploitation is unclear but the lack of sanitization suggests it could be easily abused. The vulnerability is not listed in the CISA KEV catalog, yet anyone with web access to the application can submit arbitrary content. An attacker who can authenticate or use an automated POST request can embed malicious code, which will be executed when other users view the affected page, leading to credential theft or session hijacking.