The vulnerability CVE-2026-40284 in LabRedesCefetRJ's WeGIA product is a stored XSS flaw classified under CWE-79. It arises from improper neutralization of input during web page generation, specifically in the "Destinatário" field. Authenticated users can inject malicious JavaScript that is stored and later executed when other users access the affected dispatch page. The flaw affects all versions before 3.6.10, which includes the vulnerable input handling. The CVSS 3.1 base score is 6.8, indicating a medium severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact is high confidentiality impact due to script execution in other users' sessions. The issue is fixed in version 3.6.10.

An authenticated attacker can inject and store malicious JavaScript code that executes in the browsers of other users viewing the dispatch page, potentially leading to session hijacking or other confidentiality breaches. The vulnerability does not affect integrity or availability directly. The CVSS score of 6.8 reflects a medium severity with a high confidentiality impact but no integrity or availability impact.

Upgrade WeGIA to version 3.6.10 or later, where this stored XSS vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional mitigation steps are indicated in the advisory.