CVE-2026-55680
9.8 CRITICALpublic exploit availablePublished 2026-10-14 · Updated 2026-10-15
AI risk analysis
- Summary
- A SQL injection vulnerability in WeGIA allows unauthenticated attackers to execute arbitrary SQL commands against the database by manipulating the 'codigo' parameter in a specific endpoint. This flaw enables attackers to read and modify sensitive data including user credentials and billing records without needing any authentication.
- Exploitability
- The exploit is straightforward to execute with no prerequisites, requiring only an HTTP POST request to the vulnerable endpoint with a specially crafted 'codigo' parameter value that bypasses MariaDB's type conversion for VARCHAR columns.
- Blast radius
- The vulnerability affects charitable institution management systems that use WeGIA versions prior to 3.8.6, potentially exposing sensitive user data and financial records across multiple organizations using this software.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 3.8.6 or later immediately to remediate the SQL injection vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Public exploit & PoC references
- https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa
- https://github.com/LabRedesCefetRJ/WeGIA/issues/184
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxcc-q2j6-w2rf
All references
- https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa
- https://github.com/LabRedesCefetRJ/WeGIA/issues/184
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxcc-q2j6-w2rf
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2015-20122
- CRITICALCVE-2026-55683PoC
- CRITICALCVE-2026-55684PoC
- CRITICALCVE-2023-54400PoC
- HIGHCVE-2026-100644PoC
- HIGHCVE-2026-100683PoC
- HIGHCVE-2026-102796
- HIGHCVE-2026-105076
Related by shared AI tags and CWE weakness class. Browse the full archive.