Vulnerability details

CVE-2026-33133

LabRedesCefetRJ WeGIA

WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

CVSS 4.0

8.6High

Official description

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.

CVSS scores

Score	Version	Source	Vector
8.6High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
LabRedesCefetRJ	WeGIA	>= 3.6.5, < 3.6.7	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qqff-p8fc-hg5f x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/pull/1459 x_refsource_MISC
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-20
Last updated: 2026-03-24
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.41%

Probability of exploitation in 30 days

36.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')