CVE-2026-33135

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert <div> and outputs it to the browser. This issue has been fixed in version 3.6.7.

• CWE-79

• https://github.com/LabRedesCefetRJ/WeGIA/pull/1459Issue Tracking, Patch
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7Release Notes
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w5rv-5884-w94vExploit, Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w5rv-5884-w94vExploit, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33129H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 thro…5.9
• CVE-2026-33130Uptime Kuma is an open source, self-hosted monitoring tool. …6.5
• CVE-2026-33131H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2…9.1
• CVE-2026-33132ZITADEL is an open source identity management platform. Vers…5.3
• CVE-2026-33133WeGIA is a web manager for charitable institutions. In versi…7.2
• CVE-2026-33134WeGIA is a web manager for charitable institutions. Versions…8.8
• CVE-2026-33136WeGIA is a web manager for charitable institutions. Versions…6.1
• CVE-2026-33137XWiki Platform is a generic wiki platform offering runtime s…9.3
• CVE-2026-33139PySpector is a static analysis security testing (SAST) Frame…7.8
• CVE-2026-3314Missing password field masking vulnerability in Hitachi Ops …4.6
• CVE-2026-33140PySpector is a static analysis security testing (SAST) Frame…6.1
• CVE-2026-33141Chamilo LMS is a learning management system. Prior to 2.0.0-…6.5