All vulnerabilities
CVE-2026-55681GHSA-9q8x-jqpj-23xp

WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter

LabRedesCefetRJ WeGIA
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.8.6Fixed versionGitHub
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.

Text from CVE List

Affected versions 2

  • WeGIAaffected: < 3.8.6CVE List
  • WeGIA<= 3.8.5GitHub

References 5