CVE-2026-55683 Details
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
A SQL injection vulnerability has been identified in WeGIA, a web management tool for charitable organizations, in versions prior to 3.8.6. The issue resides in the 'web/html/socio/sistema/cadastro_cobranca.php' endpoint, which processes POST requests. The vulnerability allows remote attackers to manipulate SQL queries by injecting arbitrary SQL through several unvalidated POST parameters. This could lead to unauthorized access, modification, or deletion of database content, including sensitive billing and credential information.
Users can update to WeGIA version 3.8.6 or later, where this vulnerability has been patched. Instructions for updating can be found in the WeGIA repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-vjxh-wcf9-4qgq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa | [email protected] | Source CodeVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/issues/184 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 | [email protected] | Issue TrackingVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 | [email protected] | Release NotesVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-vjxh-wcf9-4qgq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LabRedesCefetRJ WeGIA | <= 3.8.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |