Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55680: WeGIA before 3.8.6 lets outsiders run database commands

CVE-2026-55680 · published 4 days ago

Summary

The web manager for charitable groups allows anyone on the internet to send a specially crafted request to the cadastro_cobranca.php page and cause the system to execute unintended database commands. This can let an attacker read or change records such as user passwords and billing information. Upgrade to version 3.8.6 or later to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
labredescefetrj	wegia	< 3.8.6

Original advisory text

WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.

References

https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b... Patch
https://github.com/LabRedesCefetRJ/WeGIA/issues/184 Third Party Advisory
https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 Patch
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 URL
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxcc-q2j6-w2rf Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55680... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-55680 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published14 Oct 2026

Updated17 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-55680 · NVD

CVE-2026-55680 · MITRE

CVE-2026-55680 · OSV

GHSA-fxcc-q2j6-w2rf · GHSA

Track software like this

Free during beta