PT-2026-26606 · Wegia · Wegia

Bao190505 · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33135

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.6.6 and below

Description WeGIA is a web manager for charitable institutions. The software is affected by a Reflected Cross-Site Scripting (XSS) issue in the /novo memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without sanitization or encoding. The /html/memorando/novo memorandoo.php script reads HTTP GET parameters to display dynamic success messages to the user. Specifically, around line 273, the code checks if $ GET['msg'] equals 'success'. If true, it concatenates $ GET['sccs'] into an HTML alert

and outputs it to the browser.

Recommendations Versions 3.6.6 and below should be updated to version 3.6.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33135

GHSA-W5RV-5884-W94V

Affected Products

Wegia

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33135.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w5rv-5884-w94v · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1459 · Patch
• https://osv.dev/vulnerability/CVE-2026-33135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33135 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7 · Note
• https://twitter.com/0dayPublishing/status/2034991892023169255 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035104716716482688 · Twitter Post
• https://twitter.com/cyberbivash/status/2034977952576717100 · Twitter Post
• https://twitter.com/CVEnew/status/2035626983804018867 · Twitter Post
• https://twitter.com/CveFindCom/status/2034958895853011005 · Twitter Post