CVE-2026-33134

CRITICAL 9.3

WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter

CVSS Score

9.3

EPSS Score

0.0%

EPSS Percentile

9th

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id_produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar_produto.php, the application retrieves the id_produto parameter directly from the $_GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.

CWE	CWE-89
Vendor	labredescefetrj
Product	wegia
Published	Mar 20, 2026
Last Updated	Mar 20, 2026

Stay Ahead of the Next One

Get instant alerts for labredescefetrj wegia

Be the first to know when new critical vulnerabilities affecting labredescefetrj wegia are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

LabRedesCefetRJ / WeGIA

< 3.6.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qg95-x997-66wq github.com: https://github.com/LabRedesCefetRJ/WeGIA/pull/1457 github.com: https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.6