PT-2026-30733 · Wegia · Wegia

Pentestju · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35395

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.9

Description WeGIA, a Web manager for charitable institutions, contains a SQL injection issue in the 'dao/memorando/DespachoDAO.php' file. The id memorando parameter, obtained from the $ REQUEST variable, is used in SQL queries without proper validation. This allows authenticated users to execute arbitrary SQL commands against the database.

Recommendations Update to version 3.6.9 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-35395

Affected Products

Wegia

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35395 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-43jm-pcrq-w7gv · Note
• https://twitter.com/CveFindCom/status/2041270456020287934 · Twitter Post