CVE-2026-33136
Published: 20 March 2026
Summary
CVE-2026-33136 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Wegia Wegia. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires filtering and encoding of output like the reflected 'sccd' parameter before insertion into HTML to prevent arbitrary JavaScript execution in reflected XSS.
Mandates validation of input parameters such as 'sccd' to reject or sanitize malicious payloads, directly blocking XSS injection attempts.
Ensures timely remediation of known flaws like this unsanitized reflection vulnerability by applying patches such as upgrading to WeGIA 3.6.7.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution (T1059.007) in the victim's browser context when a crafted URL is visited; exploitation requires delivery via spearphishing links (T1566.002) and immediately facilitates impacts such as browser session hijacking (T1185) and keylogging (T1056.001).
NVD Description
WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then…
more
directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/listar_memorandos_ativos.php handles dynamic success messages to users using query string parameters. Similar to other endpoints in the Memorando module, it checks if $_GET['msg'] equals 'success'. If this condition is met, it directly concatenates and reflects $_GET['sccd'] into an HTML alert <div>. This issue is resolved in version 3.6.7.
Deeper analysisAI
CVE-2026-33136 is a reflected cross-site scripting (XSS) vulnerability affecting WeGIA, an open-source web manager for charitable institutions. Versions 3.6.6 and prior are vulnerable in the /html/memorando/listar_memorandos_ativos.php endpoint. The flaw occurs when the script processes query string parameters for dynamic success messages: if $_GET['msg'] equals 'success', it directly concatenates and reflects the unsanitized $_GET['sccd'] parameter into an HTML alert div, allowing arbitrary JavaScript or HTML injection. The issue is rated at CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) and maps to CWE-79.
Any unauthenticated remote attacker can exploit this vulnerability by tricking a user into visiting a malicious URL, such as one appending "?msg=success&sccd=<script>malicious payload</script>" to the endpoint. User interaction is required, typically via phishing or social engineering to induce clicks on crafted links. Successful exploitation executes arbitrary JavaScript in the victim's browser context with scope changed, enabling high-impact confidentiality and integrity violations like session hijacking, data theft from local storage, or keylogging within the WeGIA domain.
The vulnerability is resolved in WeGIA version 3.6.7, as detailed in the project's GitHub release notes and security advisory (GHSA-xjqp-5q3h-2cxh). Security practitioners should advise upgrading to 3.6.7 or later, where the sccd parameter is properly sanitized or encoded before insertion into the HTML response. No temporary workarounds are specified in the provided references.
Details
- CWE(s)