CVE-2026-6990
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross-site scripting vulnerability was found in projeto-siga siga version 11.0.3.18 in an unknown function of /sigawf/app/responsavel/novo. Manipulating the Nome/Descrição argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Risk Assessment
A remote attacker could execute a malicious script in a user's browser, potentially leading to session or data theft. The project has not responded to the report, so a fix may not be available.
Recommendation
Enforce input validation and output encoding in forms, restrict application access, and monitor for XSS attempts. Track project updates for a potential fix.
Other vulnerabilities in projeto-siga siga
See all- CVE-2026-86274Medium
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1 affecting the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java in the Authentication Flow component. Manipulation of the arguments cod/jwt leads to missing authorization. The attack may be launched remotely and the exploit is public. The project was informed but has not responded.
- CVE-2026-86273High
A weakness has been identified in projeto-siga siga up to 11.1.1. The function DownloadExterno.getUrl in the HTML-to-PDF Endpoint component is affected. Manipulation of the html argument causes server-side request forgery, which can be initiated remotely. The exploit has been made public.
Original NVD description (English source)
A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descrição results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS