CVE-2026-55681CWE-89sql-injection

CVE-2026-55681

High · published October 15, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-15T00:17Z
References (6)
https://github.com/LabRedesCefetRJ/WeGIA/commit/8fa3dfcd71c2058c3b6127fdb40d3f1ec068be3e · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/issues/99 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/pull/1705 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 14 OCT 19:44Z
    WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter
    cvelistv5
  • 14 OCT 19:44Z
    WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter
    cvelistv5