Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55684: WeGIA before 3.8.6 lets attackers run database commands

CVE-2026-55684 · published 4 days ago

Summary

The web manager for charitable groups allows anyone on the internet to send specially crafted data to a billing page, which the software adds directly into its database without checking it. This can let an attacker read, change or delete billing, member, employee and permission records, and even drop whole tables. Upgrade to version 3.8.6 or later to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
labredescefetrj	wegia	< 3.8.6

Original advisory text

WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.

References

https://github.com/LabRedesCefetRJ/WeGIA/commit/38cb19baeee90b334817fb9b40f96799... Patch
https://github.com/LabRedesCefetRJ/WeGIA/issues/183 Third Party Advisory
https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 Patch
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 URL
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g2hm-m6gw-fcgg Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55684... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-55684 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published14 Oct 2026

Updated16 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-55684 · NVD

CVE-2026-55684 · MITRE

CVE-2026-55684 · OSV

GHSA-g2hm-m6gw-fcgg · GHSA

Track software like this

Free during beta