Key points
- CVE-2026-55683 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The flaw exists in the cadastro_cobranca.php endpoint of WeGIA versions prior to 3.8.6.
- LabRedesCefetRJ released version 3.8.6 to patch the unauthenticated SQL injection issue.
WeGIA, a web management platform for charitable institutions, contains a critical security flaw that allows remote attackers to execute arbitrary SQL commands. According to the National Vulnerability Database, the vulnerability, tracked as CVE-2026-55683, carries a CVSS score of 9.8. This high-severity issue enables unauthorized users to read, modify, or delete sensitive database content, including billing records and credential data, without any form of authentication.
The vulnerability resides in the web/html/socio/sistema/cadastro_cobranca.php endpoint. Prior to version 3.8.6, this script processes POST input using the extract($_REQUEST) function. It then directly incorporates parameters such as valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements. Because the application fails to use prepared statements, these inputs are not properly sanitized, allowing malicious SQL code to be injected and executed by the database engine.
What we know
LabRedesCefetRJ addressed this vulnerability in the release of WeGIA version 3.8.6. The update patches the unauthenticated SQL injection flaw in the billing module, specifically within the cadastro_cobranca.php file. Organizations running versions earlier than 3.8.6 are exposed to this risk. The National Vulnerability Database classifies the underlying weakness as CWE-89, which relates to SQL injection. No other patches or mitigations have been confirmed for older versions.
Defender's checklist
- Verify the current installed version of WeGIA against the 3.8.6 release.
- Inspect web server logs for unusual POST requests to the cadastro_cobranca.php endpoint.
- Review database integrity checks for unexpected deletions or truncations of tables.
- Monitor for unauthorized access attempts targeting billing and credential data.
What analysts watch for
Security teams usually monitor for anomalous database query patterns that indicate injection attempts. Analysts check whether unauthenticated users are interacting with sensitive endpoints that process form data. They examine network traffic for payloads containing SQL keywords like SELECT or DROP. Teams also review application logs for errors related to malformed queries. Persistence is often achieved by modifying database contents to maintain access. Spreading may occur if stolen credentials are used to compromise other systems.
What to do and how to stay safe: WeGIA
- Upgrade your WeGIA installation to version 3.8.6 immediately to apply the vendor's fix.
- Audit your web application firewall rules to block suspicious POST requests to the affected endpoint.
- Monitor database logs for unexpected modifications or deletions to billing and user tables.
- Review access controls to ensure the cadastro_cobranca.php endpoint is not publicly accessible.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-55683?
The National Vulnerability Database rates CVE-2026-55683 as CVSS 9.8, which is considered Critical.
Which WeGIA versions are affected by this vulnerability?
All versions of WeGIA prior to 3.8.6 are affected by this unauthenticated SQL injection flaw.
Does the vulnerability require authentication to exploit?
No, the vulnerability allows remote attackers to execute arbitrary SQL without any authentication.
