PT-2026-26604 · Wegia · Wegia

Exploitintel · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-33133

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.6.5 through 3.6.6

Description WeGIA is a web manager for charitable institutions. The loadBackupDB() function imports SQL files from uploaded backup archives without content validation. An attacker can create a backup archive containing arbitrary SQL statements to create rogue administrator accounts, modify existing passwords, or execute any database operation. This issue was introduced in commit 370104c.

Recommendations Update to version 3.6.7 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-33133

GHSA-QQFF-P8FC-HG5F

Produtos afetados

Wegia

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33133.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1459 · Correção
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7 · Nota
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qqff-p8fc-hg5f · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034961882746855473 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33133 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035626985628529030 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2034978584796819625 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33133 · Nota de Segurança