Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33133WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

High 8.6

In plain English

A high-severity SQL injection in WeGIA from LabRedesCefetRJ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 63.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	>= 3.6.5, < 3.6.7

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qqff-p8fc-hg5f x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/pull/1459 x_refsource_MISC
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7 x_refsource_MISC