What is the CVSS score of CVE-2026-31896?

CVE-2026-31896 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-31896?

A critical SQL injection vulnerability (CVE-2026-31896) affects WeGIA versions up to 3.6.6, potentially allowing attackers to compromise sensitive donor and beneficiary data stored in charitable…

How to fix or mitigate CVE-2026-31896?

Within 24 hours: Inventory all systems running WeGIA and identify version numbers; isolate affected instances from direct internet access if possible. Within 7 days: Implement WAF rules to block SQL injection patterns targeting WeGIA input fields; enable enhanced logging and monitoring for suspicious database queries; conduct preliminary security assessment of affected systems. Within 30 days: Evaluate upgrade path to version 3.6.7 or later once patch becomes available; perform comprehensive database audit for signs of compromise; notify stakeholders and prepare incident response plan.

PHP CVE-2026-31896

CRITICAL

SQL Injection (CWE-89)

2026-03-11 security-advisories@github.com

PHP Denial Of Service Information Disclosure SQLi Wegia

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 20:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exists in the WeGIA application. The remover_produto_ocultar.php script uses extract($_REQUEST) to populate local variables and then directly concatenates these variables into a SQL query executed via PDO::query. This allows an authenticated (or auth-bypassed) attacker to execute arbitrary SQL commands. This can be used to exfiltrate sensitive data from the database or, as demonstrated in this PoC, cause a time-based delay (denial of service). This vulnerability is fixed in 3.6.6.