SQL Injection Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-31896

What is CVE-2026-31896?

The WeGIA web management application for charitable institutions is vulnerable to an SQL injection flaw due to improper handling of user input in the remover_produto_ocultar.php script. This vulnerability allows an authenticated user, or an attacker bypassing authentication, to execute arbitrary SQL commands through manipulated request parameters. The injected SQL can lead to unauthorized access to sensitive database information or even cause denial-of-service events via time-based attacks. This issue was resolved in version 3.6.6, emphasizing the importance of keeping software up to date to mitigate such risks.

References