CVE-2026-55680: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in LabRedesCefetRJ WeGIA
Description
CVE-2026-55680 is a critical SQL injection vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to inject arbitrary SQL via the codigo parameter in a POST request to cadastro_cobranca.php. This flaw permits reading and modifying database content, including sensitive user credentials and billing records. The vulnerability is fixed in version 3.8.6.
CVSS v3.1
Score 9.8critical
Affected software
LabRedesCefetRJ
WeGIA
pkg:github/labredescefetrj/WeGIARun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WeGIA versions before 3.8.6 contain an SQL injection vulnerability due to improper neutralization of special elements in the codigo parameter of an unauthenticated POST request to web/html/socio/sistema/cadastro_cobranca.php. The parameter is passed directly into a WHERE clause of an UPDATE statement without validation or parameter binding, allowing attackers to bypass MariaDB type conversion and execute arbitrary SQL commands. This can lead to unauthorized data disclosure and modification, including user credential hashes and billing data. The issue is resolved in version 3.8.6.
Potential Impact
An attacker can exploit this vulnerability without authentication to read or modify sensitive database content, including user credential hashes and billing records. This can lead to full compromise of data confidentiality, integrity, and availability within the affected application.
Mitigation Recommendations
Upgrade WeGIA to version 3.8.6 or later, where this SQL injection vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T00:05:03.778Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfdcbd2cdf04f656a89254
Added to database: 10/14/2026, 19:49:17 UTC
Last enriched: 10/14/2026, 20:03:21 UTC
Last updated: 10/14/2026, 20:08:21 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.