What is the CVSS score of CVE-2026-33135?

CVE-2026-33135 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33135?

WeGIA versions 3.6.6 and below contain a reflected XSS vulnerability in the novo_memorandoo.php endpoint that allows attackers to inject malicious scripts through crafted links, potentially…. A patch is available.

How to fix or mitigate CVE-2026-33135?

Within 24 hours: Identify all WeGIA instances and verify installed versions via administrative interface or application metadata. Within 7 days: Upgrade to WeGIA version 3.6.7 or later per vendor advisory; test in staging environment before production deployment. Within 30 days: Conduct security awareness training for users on recognizing phishing links, implement web application firewall rules to block suspicious sccs parameter patterns, and review access logs for evidence of exploitation attempts.

PHP CVE-2026-33135

EUVD-2026-13680 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 GitHub_M

XSS PHP

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.7

EUVD ID Assigned

Mar 20, 2026 - 11:00 euvd

EUVD-2026-13680

Analysis Generated

Mar 20, 2026 - 11:00 vuln.today

CVE Published

Mar 20, 2026 - 10:38 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert <div> and outputs it to the browser. This issue has been fixed in version 3.6.7.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in WeGIA, a web manager for charitable institutions. Versions 3.6.6 and below are affected through the novo_memorandoo.php endpoint, where an attacker can inject arbitrary JavaScript via the sccs GET parameter without sanitization. This allows execution of malicious scripts in victims' browsers when they click a crafted link, with a critical CVSS score of 9.3 due to cross-site scripting scope and high confidentiality and integrity impact.

Technical ContextAI

WeGIA (cpe:2.3:a:labredescefetrj:wegia) is a PHP-based web application for managing charitable institutions developed by LabRedesCefetRJ. The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw where user-supplied input from the sccs GET parameter is directly concatenated into HTML output around line 273 of /html/memorando/novo_memorandoo.php. The code checks if $_GET['msg'] equals 'success' and then echoes $_GET['sccs'] directly into an HTML alert div element without any encoding, escaping, or validation, allowing injected JavaScript to execute in the context of the application's origin when the success message is rendered.

RemediationAI

Upgrade WeGIA to version 3.6.7 or later, which contains the fix for this vulnerability as documented in the release notes at https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7. The patch implementation can be reviewed in pull request https://github.com/LabRedesCefetRJ/WeGIA/pull/1459 to understand the specific code changes applied. Until patching is completed, implement compensating controls such as Web Application Firewall (WAF) rules to filter script tags and JavaScript event handlers in GET parameters, particularly targeting the sccs parameter in requests to novo_memorandoo.php. Additionally, ensure Content Security Policy (CSP) headers are configured to restrict inline script execution and limit the impact of successful XSS exploitation.