VULNERABILITY INTELLIGENCE

CVE-2026-33133

CVSS score7.2 HIGH

EPSS probability0.41%

CISA KEVNot currently listed

Published2026-03-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.

Weakness classification

security-advisories@github.com: CWE-89

Primary references

security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Product, Release Notes
security-advisories@github.com — Exploit, Mitigation, Vendor Advisory