CVE Catalog
CVE-2026-35399
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.29%
21th percentile - higher than 21% of all known CVEs
Summary
WeGIA before 3.6.9 has a stored XSS vulnerability via a backup filename. An attacker can inject malicious scripts that execute in the victim's browser.
Risk Assessment
An attacker can compromise session data or execute actions on behalf of the user, leading to data theft or unauthorized operations.
Recommendation
Update WeGIA to version 3.6.9 or later.
Original NVD description (English source)
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup filename. This could lead to unauthorized execution of malicious code in the victim's browser, compromising session data or executing actions on behalf of the user. This vulnerability is fixed in 3.6.9.