CVE-2026-33135: Wegia Web Manager XSS Vulnerability

CVE-2026-33135 Overview

CVE-2026-33135 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting WeGIA, a web manager designed for charitable institutions. The vulnerability exists in the novo_memorandoo.php endpoint in versions 3.6.6 and below, where an attacker can inject arbitrary JavaScript code through the sccs GET parameter. The malicious script is directly echoed into the HTML response without any sanitization or encoding, enabling attackers to execute arbitrary code in the context of a victim's browser session.

Critical Impact
Attackers can steal session cookies, redirect users to malicious sites, deface web content, or perform actions on behalf of authenticated users by crafting malicious URLs that exploit this XSS vulnerability.

Affected Products

WeGIA versions 3.6.6 and below
WeGIA web manager installations using the novo_memorandoo.php endpoint
Charitable institution management systems running vulnerable WeGIA versions

Discovery Timeline

March 20, 2026 - CVE-2026-33135 published to NVD
March 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33135

Vulnerability Analysis

This Reflected XSS vulnerability stems from improper input validation in the WeGIA application. The vulnerable script located at /html/memorando/novo_memorandoo.php processes HTTP GET parameters to display dynamic success messages to users. At approximately line 273, the code evaluates whether the $_GET['msg'] parameter equals success. When this condition is met, the application directly concatenates the value from $_GET['sccs'] into an HTML alert <div> element and outputs it to the browser without any sanitization, encoding, or validation.

This creates a direct injection point where user-controlled input flows unsanitized into the rendered HTML, allowing attackers to inject and execute arbitrary JavaScript code in the victim's browser context. The attack requires user interaction—a victim must click a malicious link crafted by the attacker.

Root Cause

The root cause of this vulnerability is the absence of proper input sanitization and output encoding. The application directly incorporates user-supplied data from the sccs GET parameter into HTML output without applying any protective measures such as:

HTML entity encoding
Input validation or whitelisting
Content Security Policy (CSP) headers
Contextual output escaping

The PHP code assumes trust in GET parameter values and echoes them directly into the page, violating secure coding principles for handling user input.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL targeting the novo_memorandoo.php endpoint with JavaScript code injected into the sccs parameter. When a victim (typically an authenticated user of the WeGIA system) clicks the malicious link, the injected script executes in their browser session.

A typical attack flow involves crafting a URL where the msg parameter is set to success and the sccs parameter contains malicious JavaScript payload. When processed by the vulnerable endpoint, the script is rendered directly in the HTML response. The attacker could leverage this to steal session tokens stored in cookies, perform unauthorized actions using the victim's authenticated session, redirect users to phishing or malware distribution sites, or modify page content to display misleading information.

Detection Methods for CVE-2026-33135

Indicators of Compromise

Unusual URL patterns in web server logs containing JavaScript code in the sccs parameter of requests to novo_memorandoo.php
HTTP requests to /html/memorando/novo_memorandoo.php with msg=success and suspicious encoded characters in the sccs parameter
Reports from users about unexpected browser behavior or redirects when accessing WeGIA memorandum features
Web Application Firewall (WAF) alerts for XSS patterns targeting the affected endpoint

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block common XSS patterns in GET parameters, particularly targeting the sccs and msg parameters
Enable verbose web server logging and monitor for requests containing script tags, event handlers, or JavaScript URI schemes in query strings
Implement browser-based XSS auditor alerts and Content Security Policy (CSP) violation reporting
Conduct regular vulnerability scanning targeting reflected XSS in web application endpoints

Monitoring Recommendations

Configure log analysis tools to alert on requests containing potential XSS payloads such as <script>, javascript:, onerror=, or similar patterns in URL parameters
Monitor for unusual patterns of access to the novo_memorandoo.php endpoint, especially from external referrers
Implement real-time alerting for CSP violations that may indicate attempted XSS exploitation

How to Mitigate CVE-2026-33135

Immediate Actions Required

Upgrade WeGIA to version 3.6.7 or later, which contains the fix for this vulnerability
Review web server access logs for any signs of exploitation attempts targeting the novo_memorandoo.php endpoint
Implement or update Web Application Firewall rules to block XSS payloads in the sccs GET parameter
Notify users to be cautious of suspicious links pointing to the WeGIA application

Patch Information

The vulnerability has been addressed in WeGIA version 3.6.7. The fix can be obtained from the official GitHub release. The security patch was implemented through Pull Request #1459. For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-w5rv-5884-w94v.

Workarounds

If immediate patching is not possible, restrict access to the novo_memorandoo.php endpoint using web server access controls or firewall rules
Implement a reverse proxy or WAF rule to strip or encode the sccs parameter before it reaches the application
Apply a temporary code fix to sanitize the sccs parameter using PHP's htmlspecialchars() function with ENT_QUOTES flag before output
Configure Content Security Policy headers to mitigate the impact of XSS by restricting inline script execution

bash

# Example Apache .htaccess workaround to block suspicious requests
# Add to .htaccess in the WeGIA web root
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} sccs=.*(<|>|script|javascript|onerror) [NC]
    RewriteRule ^html/memorando/novo_memorandoo\.php$ - [F,L]
</IfModule>