What is the CVSS score of CVE-2026-33134?

CVE-2026-33134 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33134?

WeGIA versions 3.6.5 and below contain a critical SQL injection vulnerability affecting charitable institutions' database security.. A patch is available.

How to fix or mitigate CVE-2026-33134?

Within 24 hours: Identify all instances of WeGIA in your environment and document current versions. Within 7 days: Apply vendor patch to upgrade WeGIA to version 3.6.6 or later across all production and non-production instances. Within 30 days: Conduct database access audit, reset administrative credentials, review access logs for the restaurar_produto.php endpoint, and implement Web Application Firewall (WAF) rules to monitor SQL injection patterns on this endpoint.

PHP CVE-2026-33134

EUVD-2026-13678 CRITICAL

SQL Injection (CWE-89)

2026-03-20 GitHub_M

SQLi PHP

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.6

EUVD ID Assigned

Mar 20, 2026 - 11:00 euvd

EUVD-2026-13678

Analysis Generated

Mar 20, 2026 - 11:00 vuln.today

CVE Published

Mar 20, 2026 - 10:35 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id_produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar_produto.php, the application retrieves the id_produto parameter directly from the $_GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.

AnalysisAI

WeGIA, a web manager for charitable institutions, contains an authenticated SQL injection vulnerability in versions 3.6.5 and below via the id_producto parameter in the restaurar_produto.php endpoint. An authenticated attacker can execute arbitrary SQL commands to fully compromise the database, extracting sensitive donor information, beneficiary records, and administrative credentials. No evidence of active exploitation (not in CISA KEV) is currently available, though proof-of-concept details are publicly disclosed in the GitHub security advisory.

Technical ContextAI

WeGIA is a PHP-based web application developed by LabRedesCefetRJ for managing charitable institution operations. The vulnerability stems from CWE-89 (SQL Injection) where user-supplied input from the $_GET['id_produto'] parameter is directly concatenated into SQL query strings without sanitization, type casting, or parameterized prepared statements. The affected component is html/matPat/restaurar_produto.php, specifically in product restoration functionality within the materials/patients management module. The CPE identifier cpe:2.3:a:labredescefetrj:wegia:*:*:*:*:*:*:*:* confirms this affects the core WeGIA application across all deployment configurations.

RemediationAI

Upgrade WeGIA to version 3.6.6 or later, which includes the security fix as documented in the release notes at https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.6. The patch implementation can be reviewed in pull request #1457 at https://github.com/LabRedesCefetRJ/WeGIA/pull/1457 for organizations requiring code-level verification before deployment. Until patching is completed, implement compensating controls including restricting access to the restaurar_produto.php endpoint through web application firewall rules, enforcing strict input validation at the reverse proxy layer, limiting database user permissions to minimum required privileges, and monitoring database logs for suspicious SQL patterns or error messages indicating injection attempts. Organizations should also audit user accounts with access to the materials management module and implement principle of least privilege.