The vulnerability CVE-2026-40283 affects WeGIA versions before 3.6.10. It is a stored XSS flaw where an authenticated user can inject malicious JavaScript code through the "Nome" field on the patient information page. This code is stored in the application and executed when the patient data is accessed, potentially allowing script execution in the context of other users viewing that data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a confidentiality impact but no integrity or availability impact. The issue is resolved in version 3.6.10.

Successful exploitation allows an authenticated user to inject and store malicious JavaScript code that executes when patient information is viewed. This can lead to confidentiality breaches via script execution in the victim's browser context. There is no reported impact on data integrity or availability. The vulnerability requires high privileges (authenticated user) and no user interaction is needed for the stored script to execute upon viewing the affected page.

Upgrade WeGIA to version 3.6.10 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional vendor advisory is provided, so patch status is confirmed by the version update note. There is no indication of alternative mitigations or temporary fixes.