CVE-2026-55683

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-89

Impact

Unauthenticated remote attackers can read, modify, or delete the entire database, including billing and credential data, over the network. They need only reach the exposed PHP script.

Root cause

The application extracts unsanitized POST parameters directly into raw SQL queries without using prepared statements.

Affected systems

WeGIA prior to 3.8.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to WeGIA 3.8.6. If patching immediately is not possible, block or restrict access to the web/html/socio/sistema/cadastro_cobranca.php endpoint at the web server or reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55683