CVE-2026-55683

Summary

WeGIA web manager contains a SQL injection vulnerability in its billing management endpoint that allows unauthenticated attackers to execute arbitrary SQL commands on the database, potentially accessing or modifying sensitive data including billing records and user credentials.

Exploitability

The vulnerability is highly exploitable with no authentication required, as it directly incorporates user input into SQL queries without prepared statements, allowing attackers to perform full database read/write operations with minimal effort.

Blast radius

Exploitation could lead to complete compromise of charitable institution data including financial records, user credentials, and potentially allow attackers to delete or truncate critical application tables, causing significant operational disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.8.6 immediately to address the SQL injection vulnerability in the cadastro_cobranca.php endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.