Loading story…
WeGIA, a web management platform for charitable institutions, patched two high-severity reflected cross-site scripting vulnerabilities affecting version 3.6.6 and earlier. The flaws, tracked as CVE-2026-33135 and CVE-2026-33136, allow attacker-controlled input to be reflected into HTML responses without sanitization or output encoding, creating a path to inject arbitrary JavaScript or HTML in a victim's browser.
The first issue affects novo_memorandoo.php via the sccs GET parameter, while the second affects listar_memorandos_ativos.php via the sccd GET parameter. In both cases, the vulnerable logic is triggered when the msg parameter is set to success, causing the application to concatenate untrusted input into an alert message rendered to users. Both bugs are classified as CWE-79 with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; WeGIA addressed them in version 3.6.7 and published related GitHub advisory, release, and remediation references.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The two WeGIA reflected XSS vulnerabilities were publicly disclosed as CVE-2026-33135 and CVE-2026-33136, each classified as CWE-79 and assigned high-severity CVSS v3.1 scores. The disclosures describe impact on confidentiality and integrity and note that user interaction is required for exploitation.
The reflected XSS issues affecting WeGIA were remediated in version 3.6.7. References published with the disclosures point to associated GitHub advisory, release, and pull request materials.
Two reflected cross-site scripting vulnerabilities were identified in WeGIA: one in novo_memorandoo.php via the sccs parameter and another in listar_memorandos_ativos.php via the sccd parameter. Both flaws could allow arbitrary JavaScript or HTML injection in success-message responses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WeGIA, a web management platform for charitable institutions, was found to contain two SQL-related vulnerabilities that could let attackers manipulate or fully compromise backend databases. **CVE-2026-33134** affects version `3.6.5` and earlier in `/html/matPat/restaurar_produto.php`, where the `id_produto` parameter is incorporated into SQL queries without proper sanitization, enabling authenticated time-based blind SQL injection and arbitrary SQL command execution. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N` and was fixed in version `3.6.6`. A second flaw, **CVE-2026-33133**, affects versions `3.6.5` and `3.6.6` in the `loadBackupDB()` function, which imports SQL files from uploaded backup archives without validating their contents. A privileged attacker can submit a crafted backup archive containing malicious SQL to create rogue administrator accounts, reset passwords, or perform other unauthorized database operations. The issue is tracked as `CWE-89`, was introduced in commit `370104c`, and was patched in WeGIA version `3.6.7`.
Jun 29, 2026
Several critical and high-severity vulnerabilities have been identified in Imaster's MEMS Events CRM and Patient Records Management System, including SQL injection and stored Cross-Site Scripting (XSS) flaws. The vulnerabilities, tracked as CVE-2025-41003, CVE-2025-41004, CVE-2025-41005, and CVE-2025-41006, were discovered by Gonzalo Aguilar García (6h4ack) and coordinated by INCIBE. Specifically, SQL injection vulnerabilities exist in the 'id' parameter of `/projects/hospital/admin/complaints.php` (CVE-2025-41004), the 'keyword' parameter of `/memsdemo/exchange_offers.php` (CVE-2025-41005), and the 'phone' parameter of `/memsdemo/login.php` (CVE-2025-41006`). Additionally, a stored XSS vulnerability (CVE-2025-41003) affects the 'firstname' parameter in `/projects/hospital/admin/edit_patient.php`. All vulnerabilities are remotely exploitable, with CVSS v4.0 base scores ranging from 5.1 (medium) to 9.3 (critical), and no patches have been reported as available. The vulnerabilities impact enterprise management software used for event and patient record management, posing significant risks of unauthorized access, data exfiltration, and potential compromise of sensitive information. The SQL injection flaws, in particular, allow attackers to execute arbitrary SQL commands, potentially leading to full database compromise. The stored XSS vulnerability enables the execution of arbitrary JavaScript in the context of affected users, increasing the risk of session hijacking and further exploitation. Organizations using Imaster's MEMS Events CRM or Patient Records Management System should urgently assess their exposure and implement compensating controls until official fixes are released.
Jun 29, 2026
Two high-severity vulnerabilities in **CI4MS**, a CodeIgniter 4-based CMS skeleton, allow authenticated low-privilege users to trigger **stored DOM-based XSS** that can lead to full account takeover across roles and privilege escalation. **`CVE-2026-34558`** affects the **Methods Management** functionality, where improperly sanitized and encoded user input can be stored server-side and later executed in administrative interfaces and global navigation components. A second flaw, **`CVE-2026-34565`**, impacts **Menu Management** for posts, where malicious post data added to navigation menus can execute in both admin dashboards and public-facing menus. Both issues are classified as **CWE-79** and carry the same **CVSS v3.1** vector, `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`; they affect CI4MS versions prior to **`0.31.0.0`** and were patched in **`0.31.0.0`**.
Jun 29, 2026