CVE-2026-33991: WeGIA has SQL Injection in deletar_tag.php
WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletartag.php uses extract($REQUEST) on line 14 and directly concatenates the $idtag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33991?
CVE-2026-33991 is rated as a critical SQL Injection vulnerability that allows attackers to manipulate SQL queries.
How do I fix CVE-2026-33991?
To fix CVE-2026-33991, upgrade WeGIA to version 3.6.7 or later to eliminate the SQL injection risk.
What versions of WeGIA are affected by CVE-2026-33991?
WeGIA versions prior to 3.6.7 are affected by CVE-2026-33991.
What is the potential impact of exploiting CVE-2026-33991?
Exploiting CVE-2026-33991 can lead to unauthorized access to the database and manipulation of sensitive data.
What does the SQL Injection vulnerability in CVE-2026-33991 involve?
The SQL Injection vulnerability in CVE-2026-33991 involves improper handling of user input in the deletar_tag.php file.