CVE-2026-61719

Summary

A stored XSS flaw in WeGIA's medical record history page allows authenticated attackers to inject malicious JavaScript that executes when other users view the same record, enabling session theft and privilege escalation.

Exploitability

Exploitation requires low skill and only a valid authenticated user account with access to create or edit a patient's medical record.

Blast radius

Any staff member who views the tampered record—especially those with elevated privileges—could have their session hijacked, leading to unauthorized access to sensitive health data or system functions.

Detection

Look for unexpected JavaScript or HTML tags (e.g., `<script>`, `onerror=`, `javascript:` URIs) submitted via POST requests to `/controle/control.php` with `nomeClasse=SaudeControle` and `metodo=alterarProntuario`, especially when stored in the `textoProntuario` field; subsequent rendering of such content in `/html/saude/historico_prontuarios.php` may be observable in access logs or browser console errors if the victim's session triggers execution.

Prioritized remediation

Upgrade to WeGIA version 3.8.7 or later, which patches the stored XSS vulnerability in the `textoProntuario` field.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.