WeGIA: Unauthenticated SQL injection in billing endpoint cadastro_cobranca.php
Summary
WeGIA, a web manager for charitable institutions, contains an SQL injection flaw in the endpoint web/html/socio/sistema/cadastro_cobranca.php. The endpoint builds SQL statements from POST parameters via extract($_REQUEST) without prepared statements. A remote attacker without a login can run arbitrary SQL to read or modify billing records and credential data, or to delete or truncate tables.
Affected
- WeGIA versions prior to 3.8.6 (VulDB lists up to 3.8.5)
Fixed in
- Upgrade to WeGIA 3.8.6 or later
Workaround
Unknown. No vendor workaround is published; the fix is the upgrade to 3.8.6. Until the upgrade, restrict access to the application at the reverse proxy or WAF, or take the instance off the internet.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation status poc, automatable yes, technical impact total.
- No public exploit found for this CVE in the sources reviewed.
- EPSS score 0.00592.
Our recommendation
- Upgrade all WeGIA instances to version 3.8.6 or later as a priority, especially internet-facing ones.
- Restrict access to WeGIA from the internet until the upgrade is done.
- Check the database for unexpected changes to billing and user tables and review access logs for suspicious requests to cadastro_cobranca.php.
- Make regular database backups and test restoring them.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vjxh-wcf9-4qgq github.com
- WeGIA Release 3.8.6 github.com
- Fix commit f819be3 github.com
- WeGIA Issue #184 github.com
- WeGIA Pull Request #1705 github.com
- OpenCVE CVE-2026-55683 app.opencve.io
- VulDB 420351 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:55.
Original description (NVD)
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
NVD references (6)
- https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa
- https://github.com/LabRedesCefetRJ/WeGIA/issues/184
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-vjxh-wcf9-4qgq
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-vjxh-wcf9-4qgq
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.