Log in / Sign up

Vulnerability details

CVE-2026-55680

LabRedesCefetRJ WeGIA

WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter

CVSS 3.1
9.8Critical

Official description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.

CVSS scores

ScoreVersionSourceVector
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
LabRedesCefetRJ WeGIA < 3.8.6 CVEProject cvelistV5 (CNA)

References and advisories

5
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-10-14
Last updated
2026-10-15
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.49%
Probability of exploitation in 30 days
42.5%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-89
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')