SQL Injection Vulnerability in WeGIA Web Manager for Charitable Institutions
CVE-2026-55681

8.8HIGH

Key Information:

Vendor: Labredescefetrj
Status: Wegia
Vendor: CVE Published:; 14 October 2026

🔔 Create Labredescefetrj Vulnerability Alert

What is CVE-2026-55681?

An authenticated user with access to the Material & Patrimônio module in WeGIA Web Manager can exploit a vulnerability that allows them to submit untrusted input to a critical PHP script. This occurs before version 3.8.6, where a second call to extract($_REQUEST) bypasses the initial sanitization performed by intval(). As a result, this allows an attacker to inject arbitrary SQL code, potentially leading to unauthorized retrieval or alteration of sensitive institutional and inventory data stored in the database. This vulnerability has been addressed in version 3.8.6, and it is crucial for users to update to this version to safeguard against potential exploitation.