WeGIA Critical SQL Injection CVE-2026-55684 Fixed in 3.8.6 Update for Charity Management App

LabRedesCefetRJ released WeGIA version 3.8.6 to address a critical security flaw in the charity management platform. The vulnerability, tracked as CVE-2026-55684, allows remote attackers to execute arbitrary SQL commands without any form of authentication. This issue affects all versions of the software released before 3.8.6. Security teams managing these systems should prioritize updating to the patched release immediately to prevent unauthorized database access and potential data exfiltration of sensitive institutional records.

In plain English

The flaw exists in a specific web page used for generating billing records within the WeGIA system. The code accepts user input through a form and directly inserts that data into a database query without proper validation. An attacker can send crafted data that breaks out of the intended SQL structure. This allows the attacker to run their own commands against the database, effectively taking control of the application's data layer without needing a username or password.

The background

According to the National Vulnerability Database record, the vulnerable endpoint is located at web/html/socio/sistema/cadastro_cobrancas_geracao.php. The application uses the extract function to process request data, interpolating multiple parameters directly into a raw INSERT statement. Parameters such as billing dates, amounts, and member IDs are processed without adequate quoting or validation. This design allows string parameters to escape their context and execute malicious SQL code.

What changes now

Version 3.8.6 resolves the issue by fixing the input handling in the affected script. Organizations running older versions remain exposed to remote database manipulation via SQL injection. The National Vulnerability Database rates the severity of CVE-2026-55684 as 9.8 on the CVSS scale, classifying it as critical. The weakness is categorized under CWE-89, which covers SQL injection flaws. Deploying the new version eliminates the vector that allowed unauthenticated database manipulation.

Who needs to act first

Security operations teams should identify all instances of WeGIA running versions older than 3.8.6 immediately. Prioritize systems that are exposed to the public internet or accessible to untrusted networks. Before applying the update, create a full backup of the current database and configuration files to ensure recovery options exist if the upgrade fails. Test the patch in a non-production environment first to verify compatibility with existing workflows. Monitor logs for any unusual database activity during the transition period.

What to do and how to stay safe: WeGIA

• Verify the current version of WeGIA installed on all servers and compare it against the patched 3.8.6 release.
• Apply the update to production systems after validating it in a staging environment to ensure operational stability.
• Review database logs for signs of unauthorized SQL execution or unusual data modifications prior to the patch.
• Restrict network access to the application interface to trusted IP ranges if immediate patching is not possible.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific CVE ID tracks this vulnerability?

This vulnerability is tracked as CVE-2026-55684 in the National Vulnerability Database.

Is there a fix available for this SQL injection flaw?

Yes, the vendor released version 3.8.6 which fixes the issue.

What type of data is at risk from this vulnerability?

Attackers can read, modify, or delete billing, member, employee, permission, and credential data.