SQL Injection Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-55680

What is CVE-2026-55680?

The WeGIA Web Manager for charitable institutions is susceptible to SQL injection attacks due to a lack of validation in its handling of POST requests. Specifically, the vulnerability exists in the 'codigo' parameter of 'web/html/socio/sistema/cadastro_cobranca.php', where an attacker can submit unauthenticated requests containing a crafted SQL query. This allows unauthorized access to modify or read sensitive database information, such as user credential hashes and billing details stored in the 'cobrancas' table. This significant security flaw has been addressed in version 3.8.6.

References