CVE-2026-55684

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-89

Impact

Unauthenticated remote attackers can execute arbitrary SQL commands to dump or alter credentials, billing, and member data, or drop database tables. All they need is network access to post data to the affected endpoint.

Root cause

The endpoint runs extract($_REQUEST) on user POST data and concatenates unvalidated and unquoted parameters directly into a raw SQL INSERT statement.

Affected systems

WeGIA prior to 3.8.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade WeGIA to version 3.8.6 or later. If patching immediately is not possible, block network access to web/html/socio/sistema/cadastro_cobrancas_geracao.php at your reverse proxy or web server.

shell

$ git fetch --tags && git checkout v3.8.6

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-55684