High severity · published Oct 14, 2026
CVE-2026-55681
WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WeGIA · LabRedesCefetRJ
< 3.8.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55681
github.com
https://github.com/LabRedesCefetRJ/WeGIA/commit/8fa3dfcd71c2058c3b6127fdb40d3f1ec068be3e
github.com
https://github.com/LabRedesCefetRJ/WeGIA/issues/99
github.com
https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
github.com
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
github.com
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp
More from WeGIA
9.8
CVE-2026-55684
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
9.8
CVE-2026-55680
WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
9.8
CVE-2026-55683
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
9.8
CVE-2026-31896
WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php
9.8
CVE-2026-28411
WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`