CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
Remote attackers can execute arbitrary SQL via unauthenticated POST requests to read or modify sensitive institutional data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55684?
CVE-2026-55684 is a critical SQL injection vulnerability in LabRedesCefetRJ WeGIA, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
Weakness: CWE-89
Which versions are affected by CVE-2026-55684?
How do I fix CVE-2026-55684?
No fix has been published for CVE-2026-55684 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-55684 being exploited?
There is no known exploitation of CVE-2026-55684 in the wild and no public exploit code.
Sources
Also known as GHSA-g2hm-m6gw-fcgg.