PT-2026-30733 · Wegia · Wegia

Pentestju · CVE-2026-35395 · Published 2026-04-06 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.9

Description WeGIA, a Web manager for charitable institutions, contains a SQL injection issue in the 'dao/memorando/DespachoDAO.php' file. The id memorando parameter, obtained from the $ REQUEST variable, is used in SQL queries without proper validation. This allows authenticated users to execute arbitrary SQL commands against the database.

Recommendations Update to version 3.6.9 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-35395

GHSA-43JM-PCRQ-W7GV

Affected Products

Wegia

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35395.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-43jm-pcrq-w7gv · Exploit
• https://osv.dev/vulnerability/CVE-2026-35395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35395 · Security Note
• https://twitter.com/DFIR_Lab/status/2041658687077470405 · Twitter Post
• https://twitter.com/CveFindCom/status/2041270456020287934 · Twitter Post