Cyber Posture

CVE-2026-33136

CriticalPublic PoC

Published: 20 March 2026

Published
20 March 2026
Modified
20 March 2026
KEV Added
Patch
CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS Score 0.0005 15.1th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33136 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Wegia Wegia. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to JavaScript (T1059.007) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires filtering and encoding of output like the reflected 'sccd' parameter before insertion into HTML to prevent arbitrary JavaScript execution in reflected XSS.

prevent

Mandates validation of input parameters such as 'sccd' to reject or sanitize malicious payloads, directly blocking XSS injection attempts.

prevent

Ensures timely remediation of known flaws like this unsanitized reflection vulnerability by applying patches such as upgrading to WeGIA 3.6.7.

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1056.001 Keylogging Collection
Adversaries may log user keystrokes to intercept credentials as the user types them.
Why these techniques?

Reflected XSS directly enables arbitrary JavaScript execution (T1059.007) in the victim's browser context when a crafted URL is visited; exploitation requires delivery via spearphishing links (T1566.002) and immediately facilitates impacts such as browser session hijacking (T1185) and keylogging (T1056.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then…

more

directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/listar_memorandos_ativos.php handles dynamic success messages to users using query string parameters. Similar to other endpoints in the Memorando module, it checks if $_GET['msg'] equals 'success'. If this condition is met, it directly concatenates and reflects $_GET['sccd'] into an HTML alert <div>. This issue is resolved in version 3.6.7.

Deeper analysisAI

CVE-2026-33136 is a reflected cross-site scripting (XSS) vulnerability affecting WeGIA, an open-source web manager for charitable institutions. Versions 3.6.6 and prior are vulnerable in the /html/memorando/listar_memorandos_ativos.php endpoint. The flaw occurs when the script processes query string parameters for dynamic success messages: if $_GET['msg'] equals 'success', it directly concatenates and reflects the unsanitized $_GET['sccd'] parameter into an HTML alert div, allowing arbitrary JavaScript or HTML injection. The issue is rated at CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) and maps to CWE-79.

Any unauthenticated remote attacker can exploit this vulnerability by tricking a user into visiting a malicious URL, such as one appending "?msg=success&sccd=<script>malicious payload</script>" to the endpoint. User interaction is required, typically via phishing or social engineering to induce clicks on crafted links. Successful exploitation executes arbitrary JavaScript in the victim's browser context with scope changed, enabling high-impact confidentiality and integrity violations like session hijacking, data theft from local storage, or keylogging within the WeGIA domain.

The vulnerability is resolved in WeGIA version 3.6.7, as detailed in the project's GitHub release notes and security advisory (GHSA-xjqp-5q3h-2cxh). Security practitioners should advise upgrading to 3.6.7 or later, where the sccd parameter is properly sanitized or encoded before insertion into the HTML response. No temporary workarounds are specified in the provided references.

Details

CWE(s)

Affected Products

wegia
wegia
≤ 3.6.7

CVEs Like This One

CVE-2026-33135Same product: Wegia Wegia
CVE-2025-22598Same product: Wegia Wegia
CVE-2026-40283Same product: Wegia Wegia
CVE-2025-22597Same product: Wegia Wegia
CVE-2026-23722Same product: Wegia Wegia
CVE-2024-57030Same product: Wegia Wegia
CVE-2025-22132Same product: Wegia Wegia
CVE-2025-30361Same product: Wegia Wegia
CVE-2025-22133Same product: Wegia Wegia
CVE-2025-26612Same product: Wegia Wegia

References