CVE-2026-55681

8.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-89

Impact

Authenticated attackers with Material & Patrimônio module access can execute arbitrary SQL to extract sensitive records or modify institutional and inventory data. Exploitation requires network access and an authenticated account with module permissions.

Root cause

A redundant extract($_REQUEST) call overwrites a sanitized integer variable, allowing raw user input to be directly interpolated into UPDATE SQL statements.

Affected systems

WeGIA versions prior to 3.8.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade WeGIA to version 3.8.6 or later. If upgrading immediately is not possible, restrict access to web/html/matPat/restaurar_produto_desocultar.php or revoke Material & Patrimônio module permissions from non-essential accounts.

shell

$ git fetch --tags && git checkout v3.8.6

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55681