https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:43:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276631 EUVD-2026-276631 https://cve.radiocsirt.org/vuln/euvd-2026-276631 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33135 <p>WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET[&#39;msg&#39;] equals &#39;success&#39;. If true, it directly concatenates $_GET[&#39;sccs&#39;] into an HTML alert &lt;div&gt; and outputs it to the browser. This issue has been fixed in version 3.6.7.</p> <p>WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET[&#39;msg&#39;] equals &#39;success&#39;. If true, it directly concatenates $_GET[&#39;sccs&#39;] into an HTML alert &lt;div&gt; and outputs it to the browser. This issue has been fixed in version 3.6.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33135