CVE-2026-31895:

SQL injection vulnerability in WeGIA web manager for charitable institutions prior to version 3.6.6.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Mar 11, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

SQL injection vulnerability in WeGIA web manager for charitable institutions prior to version 3.6.6.

Overview

The vulnerability in WeGIA allows potential attackers to inject malicious SQL code through the id_produto parameter in the restaurar_produto.php file. This security flaw can lead to unauthorized access, data manipulation, or extraction of sensitive information from the database. The vulnerability is classified as CWE-89, which refers to improper neutralization of special elements used in SQL commands. With a CVSS v3.1 base score of 8.8, this vulnerability is considered high severity. The attack vector is network-based, requires low attack complexity and low privileges, and does not need user interaction. If successfully exploited, it could result in high impacts on confidentiality, integrity, and availability of the affected system.

Remediation

To address this vulnerability, users should upgrade WeGIA to version 3.6.6 or later. The fix implemented in this version likely includes proper input validation, parameterized queries, or other SQL injection prevention techniques. Organizations using WeGIA should prioritize this update to mitigate the risk of potential attacks. Additionally, it is recommended to follow general security best practices such as implementing least privilege access, regular security audits, and monitoring for suspicious activities.

References

[1] GitHub Security Advisory. "SQL Injection in WeGIA." GitHub, 11 Mar. 2026, github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m39r-p62f-vmqm.