CVE-2026-55681
Deferred Deferred - Pending Action

Authenticated SQL Injection in WeGIA Web Manager Prior to 3.8.6

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-55681
EUVD
EUVD-2026-101622

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LabRedesCefetRJ WeGIA < 3.8.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in WeGIA, a web manager for charitable institutions. An authenticated user with access to the Material & Patrimônio module can exploit the id_produto parameter in the file web/html/matPat/restaurar_produto_desocultar.php. The vulnerability occurs because the code uses extract($_REQUEST) twice, where the second call overwrites a sanitized value with raw user input. This unsanitized input is then directly used in SQL UPDATE queries for the produto, isaida, and ientrada tables, allowing attackers to execute arbitrary SQL commands.

Detection Guidance

To detect this vulnerability, check if your WeGIA instance is running a version prior to 3.8.6. Inspect the file web/html/matPat/restaurar_produto_desocultar.php for the use of extract($_REQUEST) and direct variable interpolation in SQL queries. Look for id_produto parameter handling without prepared statements.

Impact Analysis

This vulnerability allows attackers to extract sensitive database records or modify institutional and inventory data. Since it affects SQL UPDATE operations, it can lead to unauthorized changes in product, entry, and exit records. The high CVSS score (8.8) indicates significant potential impact on confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or modification. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A successful SQL injection could expose or alter such data, violating these regulations and potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade WeGIA to version 3.8.6 or later. Remove the extract($_REQUEST) calls in the vulnerable file and replace direct SQL variable interpolation with prepared statements using named parameters like :idProduto. Validate id_produto as an integer before query execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart