Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert <div> and outputs it to the browser. This issue has been fixed in version 3.6.7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 4 | Disclosure2General1Patch1 |
| 2026-03-22 | 1 | Disclosure1 |
| 2026-03-23 | 1 | Disclosure1 |
CVE-2026-33135: WeGIA Reflected XSS Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q047VB-g0
Post summary
The text announces a new reflected XSS vulnerability (CVE-2026-33135) but provides no PoC, exploit code, evidence of active exploitation, or patch information.
CVE-2026-33135 WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endp… https://www.cve.org/CVERecord?id=CVE-2026-33135
Post summary
This entry announces a reflected XSS flaw (CVE‑2026‑33135) in WeGIA versions 3.6.6 and older, but contains no proof‑of‑concept, exploit code, active exploitation evidence, or patch details.
🔴 CVE-2026-33135 - Critical WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can... https://www.thehackerwire.com/vulnerability/CVE-2026-33135/ https://t.co/uVH7U9eUmy
Post summary
CVE-2026-33135 is a reflected XSS flaw affecting WeGIA 3.6.6 and earlier, with no disclosed PoC, patches, or evidence of active exploitation reported.
🚨 CVE-2026-33135: WeGIA ... Charitable institution software with GET parameter directly echoed to DOM - classic textbook XSS that screams automated exploitation #XSS #WeGIA. https://zerodaysignal.com/vulnerability/CVE-2026-33135 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-33135, an XSS flaw in a charitable institution software, linking to a zero‑day page without providing exploit code or a patch.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33135 - WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter Intel Report: https://ift.tt/XMuWgHd
Post summary
The alert discloses a reflected XSS vulnerability in a specific PHP file, noting the affected parameter, but offers no PoC, exploit, patch, or evidence of active exploitation.
[CVE-2026-33135: CRITICAL] Web manager WeGIA had XSS vulnerability in versions 3.6.6 and below. Attackers could inject JavaScript via sccs parameter in novo_memorandoo.php. The flaw is fixed in v3.6.7.#cve,CVE-2026-33135,#cybersecurity https://cvefind.com/CVE-2026-33135
Post summary
The text announces an XSS vulnerability in Web manager WeGIA, provides technical details, and confirms it has been fixed in a newer version.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wegia | wegia | - | - | - |