SQL Injection Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-55684

What is CVE-2026-55684?

The WeGIA web manager for charitable institutions has an SQL injection vulnerability due to improper handling of user-supplied input. Specifically, the endpoint '/socio/sistema/cadastro_cobrancas_geracao.php' allows unauthenticated POST requests that can manipulate SQL commands. Numeric parameters are not validated, and string parameters can escape quotes, leading to potential unauthorized access. This vulnerability could allow remote attackers to execute arbitrary SQL queries, compromising sensitive data such as billing and membership information. The issue has been addressed in version 3.8.6.

References