The vulnerability CVE-2026-40283 in LabRedesCefetRJ's WeGIA product is a stored XSS flaw present in versions before 3.6.10. An authenticated user can inject malicious JavaScript through the "Nome" field on the patient information page. The payload is stored in the system and executed when the patient data is accessed, potentially impacting confidentiality by executing scripts in the context of other users. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact. The issue is fixed in version 3.6.10.

Successful exploitation allows an authenticated user to inject and store malicious JavaScript code that executes when patient information is viewed. This can lead to confidentiality breaches such as session hijacking or data exposure within the affected application context. The vulnerability does not impact integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Upgrade WeGIA to version 3.6.10 or later, where this stored XSS vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional vendor advisory is provided, so patch status beyond this version upgrade is not confirmed. Patch status is considered fixed in 3.6.10.