CVE-2026-55680

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-89

Impact

Unauthenticated remote attackers can read or alter database contents, including user credential hashes and billing records, with simple HTTP POST requests. No account or user interaction is required.

Root cause

The application extracts unvalidated request parameters directly into variable scope with extract($_REQUEST) and concatenates the codigo value straight into an UPDATE SQL query without parameter binding.

Affected systems

WeGIA prior to 3.8.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade WeGIA to version 3.8.6. As an interim workaround, block external access to web/html/socio/sistema/cadastro_cobranca.php at your reverse proxy or web server.

shell

$ git fetch --tags && git checkout v3.8.6

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55680