LeakyCreds
NewInstant webhook alerts now available — notified within seconds of any credential detection.Learn more →
Home / Vulnerability Intelligence / CVE-2026-33991

CVE-2026-33991 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: March 27, 2026

WeGIA - SQL Injection

Published: March 27, 2026Updated: March 27, 2026Remote Exploitable

Overview

WeGIA < 3.6.7 contains a SQL injection caused by unsanitized use of extract($_REQUEST) and direct concatenation of $id_tag in SQL queries in html/socio/sistema/deletar_tag.php, letting attackers execute arbitrary SQL commands, exploit requires crafted request.

Severity & Score

Severity: High
CVSS Score: 8.8
EPSS Score: 4.7%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or deletion.

Mitigation

Upgrade to version 3.6.7 or later.

References

Social Media Activity(4 posts)

Offensive Sequence
Offensive Sequence
@offseq
Mar 28, 2026

⚠️ CVE-2026-33991: HIGH severity SQL Injection in WeGIA < 3.6.7. Vulnerable PHP code in deletar_tag.php lets attackers inject SQL remotely — risking data theft & disruption for charities. Patch to 3.6.7 or mitigate ASAP. https://radar.offseq.com/threat/cve-2026-33991-cwe-89-improper-neutralization-of-s-585124c0 #OffSeq #SQLInjection #Infosec

View original post
TheHackerWire
TheHackerWire
@thehackerwire
Mar 27, 2026

🟠 CVE-2026-33991 - High (8.8) WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33991/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post
Offensive Sequence
Offensive Sequence
@offseq
Mar 28, 2026

⚠️ CVE-2026-33991: HIGH severity SQL Injection in WeGIA < 3.6.7. Vulnerable PHP code in deletar_tag.php lets attackers inject SQL remotely — risking data theft & disruption for charities. Patch to 3.6.7 or mitigate ASAP. https://radar.offseq.com/threat/cve-2026-33991-cwe-89-improper-neutralization-of-s-585124c0 #OffSeq #SQLInjection #Infosec

View original post
TheHackerWire
TheHackerWire
@thehackerwire
Mar 27, 2026

🟠 CVE-2026-33991 - High (8.8) WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33991/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID
CVE-2026-33991
Severity
High
CVSS Score
8.8
Type
sql_injection
Status
new
EPSS
4.7%
Social Posts
4

CWE

  • CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

4.7%Probability of exploitation in the next 30 days