---
id: CVE-2026-55683
title: WeGIA is a web manager for charitable institutions
summary: >-
  WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the
  unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts
  POST input through extract($_REQUEST) and directly incorporates valor,
  valor_pago, id_p…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:17:50.750'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55683'
references:
  - url: >-
      https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa
    label: security-advisories@github.com
  - url: 'https://github.com/LabRedesCefetRJ/WeGIA/issues/184'
    label: security-advisories@github.com
  - url: 'https://github.com/LabRedesCefetRJ/WeGIA/pull/1705'
    label: security-advisories@github.com
  - url: 'https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-vjxh-wcf9-4qgq
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-14T20:53:12.381Z'
---

## Overview

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.