SQL Injection Vulnerability in WeGIA Web Manager for Charities

CVE-2026-55683

What is CVE-2026-55683?

WeGIA, a web management tool for charitable institutions, is vulnerable through its unauthenticated endpoint, allowing attackers to inject arbitrary SQL commands. The endpoint, which processes POST requests without the use of prepared statements, can be exploited to manipulate database entries. This includes reading or altering sensitive information such as billing records and user credentials, which poses a significant data breach risk. Additionally, attackers may delete or truncate tables, potentially leading to severe data loss. Users are advised to upgrade to version 3.8.6, which addresses this vulnerability and enhances overall security.

References