CVE-2026-33991: WeGIA has SQL Injection in deletar_tag.php

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-89

Description

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerability.

Affected products

LabRedesCefetRJ WeGIA: before 3.6.7 — fixed in 3.6.7

How to fix

Upgrade to a fixed version: LabRedesCefetRJ WeGIA 3.6.7. Check the vendor advisory for mitigations.

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-74xm-6wgf-x37j
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-74xm-6wgf-x37j

Get alerted when CVE-2026-33991 or the next vulnerability affects your stack