Vulnerability details
CVE-2026-55684
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
Official description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| LabRedesCefetRJ | WeGIA | < 3.8.6 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g2hm-m6gw-fcgg x_refsource_CONFIRM
- https://github.com/LabRedesCefetRJ/WeGIA/issues/183 x_refsource_MISC
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 x_refsource_MISC
- https://github.com/LabRedesCefetRJ/WeGIA/commit/38cb19baeee90b334817fb9b40f967996c9ee36b x_refsource_MISC
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 x_refsource_MISC
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-15
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')