CVE-2026-33133 - Vulnerability Analysis

Overview

WeGIA 3.6.5 and 3.6.6 contain a SQL injection caused by lack of content validation in loadBackupDB() function importing SQL files from backup archives, letting attackers execute arbitrary database operations remotely, exploit requires crafted backup archive upload.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands, creating rogue admin accounts or modifying passwords, leading to full database compromise.

Mitigation

Upgrade to version 3.6.7 or later.

References

• https://github.com/LabRedesCefetRJ/WeGIA/pull/1459
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qqff-p8fc-hg5f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner