What is the CVSS score of CVE-2026-33136?

CVE-2026-33136 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33136?

WeGIA versions 3.6.6 and below contain a reflected XSS vulnerability in the listar_memorandos_ativos.php endpoint that allows attackers to inject malicious scripts without authentication, potentially…. A patch is available.

How to fix or mitigate CVE-2026-33136?

Within 24 hours: inventory all WeGIA deployments and document current versions. Within 7 days: apply the vendor-released patch to all systems running WeGIA 3.6.6 or below; verify patch deployment in non-production environment first. Within 30 days: conduct security awareness training for end users on phishing/malicious links, implement Web Application Firewall rules to block suspicious sccd parameter patterns, and review access logs for evidence of exploitation.

PHP CVE-2026-33136

EUVD-2026-13682 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 GitHub_M

XSS PHP

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.7

EUVD ID Assigned

Mar 20, 2026 - 11:00 euvd

EUVD-2026-13682

Analysis Generated

Mar 20, 2026 - 11:00 vuln.today

CVE Published

Mar 20, 2026 - 10:41 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/listar_memorandos_ativos.php handles dynamic success messages to users using query string parameters. Similar to other endpoints in the Memorando module, it checks if $_GET['msg'] equals 'success'. If this condition is met, it directly concatenates and reflects $_GET['sccd'] into an HTML alert <div>. This issue is resolved in version 3.6.7.

AnalysisAI

WeGIA, a web manager for charitable institutions, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint affecting versions 3.6.6 and below. An attacker can inject arbitrary JavaScript or HTML into the sccd GET parameter, which is reflected without sanitization when the msg parameter equals 'success', enabling session hijacking, credential theft, and malicious actions in the context of victim users. The vulnerability has a critical CVSS score of 9.3 with changed scope, indicating potential impact beyond the vulnerable component.

Technical ContextAI

The vulnerability exists in WeGIA (cpe:2.3:a:labredescefetrj:wegia:*:*:*:*:*:*:*:*), a PHP-based web application for managing charitable organizations. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The listar_memorandos_ativos.php script in the Memorando module handles dynamic success messages by checking if $_GET['msg'] equals 'success' and then directly concatenates $_GET['sccd'] into an HTML alert div element without any input validation, output encoding, or sanitization. This pattern of unsafe parameter handling appears to be replicated across multiple endpoints in the Memorando module, suggesting a systemic input validation issue in the application's architecture.

RemediationAI

Upgrade WeGIA to version 3.6.7 or later, which resolves this vulnerability according to the release notes available at https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7. Organizations should review the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xjqp-5q3h-2cxh for complete remediation guidance. Until patching is possible, implement compensating controls including Web Application Firewall (WAF) rules to filter malicious script tags in the sccd parameter, Content Security Policy (CSP) headers to prevent inline script execution, and user awareness training to avoid clicking suspicious links. Conduct a security review of other endpoints in the Memorando module for similar input validation issues, as the advisory suggests this pattern may exist across multiple scripts.