The vulnerability CVE-2026-40284 affects WeGIA versions prior to 3.6.10 and involves improper neutralization of input during web page generation (CWE-79). Specifically, authenticated users can inject stored malicious JavaScript code through the "Destinatário" field. This code is stored on the server and executed when other users access the dispatch page, enabling cross-site scripting attacks. The vulnerability has a CVSS 3.1 score of 6.8 with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality but not integrity or availability. The issue is resolved in version 3.6.10. No cloud service is involved, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated attacker to inject and store malicious JavaScript that executes in other users' browsers when they view the affected page. This can lead to unauthorized disclosure of sensitive information (confidentiality impact). There is no reported impact on integrity or availability. The vulnerability requires high privileges (authenticated user) and no user interaction is needed for the payload to execute once stored.

Upgrade WeGIA to version 3.6.10 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor or trusted source. No other mitigation or temporary fix is indicated. Patch status beyond the version fix note is not explicitly confirmed; check vendor resources for current remediation guidance.