9.8
CriticalCVSS 3.1 · from GitHub_M
CVE-2026-55684
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
WeGIA · SQL injection · CWE-89AffectedWeGIA
FixNo fix listed yet.
PublishedOct 14, 19:46 · GitHub_M
ScoredOct 14 · 9.8 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inWeGIA< 3.8.6–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known