PT-2026-26604 · Wegia · Wegia

Exploitintel · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33133

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.6.5 through 3.6.6

Description WeGIA is a web manager for charitable institutions. The loadBackupDB() function imports SQL files from uploaded backup archives without content validation. An attacker can create a backup archive containing arbitrary SQL statements to create rogue administrator accounts, modify existing passwords, or execute any database operation. This issue was introduced in commit 370104c.

Recommendations Update to version 3.6.7 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33133

GHSA-QQFF-P8FC-HG5F

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33133.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1459 · Patch
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qqff-p8fc-hg5f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33133 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7 · Note
• https://twitter.com/VulmonFeeds/status/2034961882746855473 · Twitter Post
• https://twitter.com/CVEnew/status/2035626985628529030 · Twitter Post
• https://twitter.com/cyberbivash/status/2034978584796819625 · Twitter Post