CVE-2026-55681 Details
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
A SQL injection vulnerability has been identified in WeGIA, a web management application for charitable institutions, in versions prior to 3.8.6. The issue resides in the 'Material & Patrimônio' module, where an authenticated user can exploit the 'id_produto' parameter in 'web/html/matPat/restaurar_produto_desocultar.php'. The vulnerability arises because a second 'extract($_REQUEST)' call overwrites a previously sanitized value, allowing raw input to be interpolated into SQL UPDATE statements for multiple database tables. This exploitation enables attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.
Users can update to WeGIA version 3.8.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/commit/8fa3dfcd71c2058c3b6127fdb40d3f1ec068be3e | [email protected] | Source CodeVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/issues/99 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 | [email protected] | Issue TrackingVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 | [email protected] | Release NotesVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeGIA | <= 3.8.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |