CVE-2026-35395CWE-89

WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter

High · published April 6, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in 3.6.9.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00464 · 39.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-06T21:01Z
EPSS history
Timeline
  • 06 APR 21:01Z
    WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
    cvelistv5