What is the CVSS score of CVE-2026-33991?

CVE-2026-33991 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33991?

WeGIA charitable management software versions prior to 3.6.7 contain a SQL injection vulnerability in the tag deletion module that allows authenticated users to execute arbitrary database queries,…. A patch is available.

How to fix or mitigate CVE-2026-33991?

Within 24 hours: Identify all systems running WeGIA versions prior to 3.6.7 and isolate them from production if feasible, or restrict access to the tag deletion module. Within 7 days: Apply vendor patch to upgrade all instances to WeGIA 3.6.7 or later, beginning with non-production environments. Within 30 days: Conduct database access logs review for the past 90 days to identify any suspicious SQL activity in deletar_tag.php, and implement database activity monitoring on the affected module.

PHP CVE-2026-33991

EUVD-2026-16884 HIGH

SQL Injection (CWE-89)

2026-03-27 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:11 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.7

EUVD ID Assigned

Mar 27, 2026 - 22:46 euvd

EUVD-2026-16884

Analysis Generated

Mar 27, 2026 - 22:46 vuln.today

CVE Published

Mar 27, 2026 - 22:10 nvd

HIGH 8.8

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletar_tag.php uses extract($_REQUEST) on line 14 and directly concatenates the $id_tag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerability.

AnalysisAI

SQL injection in WeGIA charitable institution management software allows authenticated remote attackers to execute arbitrary database queries with high impact to confidentiality, integrity, and availability. The vulnerability stems from unsafe use of extract($_REQUEST) combined with unsanitized SQL concatenation in the tag deletion module (deletar_tag.php), affecting all versions prior to 3.6.7. No public exploit identified at time of analysis, with EPSS probability data not available for this recent CVE.

Technical ContextAI

WeGIA is a PHP-based web management platform for charitable institutions maintained by LabRedesCefetRJ. The vulnerability exists in html/socio/sistema/deletar_tag.php where the code uses extract($_REQUEST) on line 14, which unpacks all GET/POST parameters into local variables. The extracted $id_tag variable is then directly concatenated into SQL queries on lines 16-17 without parameterized statements or input validation, creating a classic SQL injection vector (CWE-89). The extract() function is particularly dangerous in PHP as it allows attackers to overwrite existing variables or inject new ones by controlling HTTP request parameters. This anti-pattern combined with dynamic SQL construction enables attackers to manipulate query logic, bypass authentication checks, extract sensitive data, modify records, or potentially execute database-level commands depending on the database user's privileges.

RemediationAI

Vendor-released patch: WeGIA version 3.6.7 fully remediates this vulnerability by implementing proper input sanitization and likely replacing direct SQL concatenation with prepared statements in the deletar_tag.php module. Organizations running WeGIA should immediately upgrade to version 3.6.7 or later by obtaining the patched release from the official GitHub repository at https://github.com/LabRedesCefetRJ/WeGIA. The security advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-74xm-6wgf-x37j provides detailed vulnerability information and upgrade instructions. As a temporary workaround if immediate patching is not feasible, administrators could restrict access to the deletar_tag.php endpoint through web server configuration rules or implement web application firewall rules to filter suspicious input patterns targeting the id_tag parameter, though these measures should be considered temporary mitigations only while planning for the definitive upgrade to 3.6.7.