SB2026070747 - Multiple vulnerabilities in WeGIA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026070747

SB2026070747 - Multiple vulnerabilities in WeGIA

Published: July 7, 2026

Security Bulletin ID SB2026070747
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 91% Medium 9%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify payment records and mark payments as paid.

The vulnerability exists due to missing authorization in atualiza_pagamentos.php when handling unauthenticated POST requests to the payment update endpoint. A remote attacker can send a specially crafted request to modify payment records and mark payments as paid.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify member personal data.

The vulnerability exists due to missing authorization in processa_edicao_socio.php when handling unauthenticated requests to the member edit endpoint. A remote attacker can send a specially crafted request to overwrite member information to modify member personal data.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create billing records.

The vulnerability exists due to missing authorization in cadastro_cobranca.php when handling unauthenticated requests to the billing creation endpoint. A remote attacker can send a specially crafted request to create billing records.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to generate charge records.

The vulnerability exists due to missing authorization in cadastro_cobrancas_geracao.php when handling unauthenticated requests to the charge generation endpoint. A remote attacker can send a specially crafted request to generate charge records.


5) OS Command Injection (CVE-ID: CVE-2026-55679)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to command injection in web/instalador/instalador.php when processing unauthenticated installer POST data in the Linux reinstall flow. A remote attacker can send a specially crafted request to execute arbitrary commands.

The endpoint is reachable before config.php exists in pre-installation scenarios.


6) SQL injection (CVE-ID: CVE-2026-55680)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL queries against the database.

The vulnerability exists due to SQL injection in cadastro_cobranca.php when handling the user-supplied codigo parameter. A remote attacker can send a specially crafted request to execute arbitrary SQL queries against the database.

The affected endpoint does not perform authentication checks before processing the request.


7) SQL injection (CVE-ID: CVE-2026-55681)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands and disclose sensitive information.

The vulnerability exists due to SQL injection in html/matPat/restaurar_produto_desocultar.php when handling the id_produto parameter in requests. A remote user can send a specially crafted request to execute arbitrary SQL commands and disclose sensitive information.

Exploitation requires access to the Material & Patrimônio module.


8) Session Fixation (CVE-ID: CVE-2026-55682)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to fixate a victim's session and disclose sensitive information.

The vulnerability exists due to session fixation in html/seguranca/sessionStart.php when handling requests with a user-controlled PHPSESSID cookie. A remote attacker can supply a crafted PHPSESSID cookie value to fixate a victim's session and disclose sensitive information.

User interaction is required because the victim must authenticate after the attacker-controlled session identifier is set.


9) SQL injection (CVE-ID: CVE-2026-55683)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in html/socio/sistema/cadastro_cobranca.php when handling crafted POST requests to the /html/socio/sistema/cadastro_cobranca.php endpoint. A remote attacker can submit specially crafted integer parameters to execute arbitrary SQL commands.

The issue affects multiple unescaped integer parameters, including codigo, valor, valor_pago, id_pessoa, id_socio, and id_sociotipo.


10) SQL injection (CVE-ID: CVE-2026-55684)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in html/socio/sistema/cadastro_cobrancas_geracao.php when handling POST requests to /html/socio/sistema/cadastro_cobrancas_geracao.php. A remote attacker can send a specially crafted request with malicious parameter values to execute arbitrary SQL commands.

The issue affects multiple POST parameters, including both unquoted integer fields and string fields that can break out of single-quoted SQL context.


11) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to generate arbitrary charge records.

The vulnerability exists due to improper access control in cadastro_cobrancas_geracao.php when handling charge-generation requests. A remote attacker can send an unauthenticated request to generate arbitrary charge records.


Remediation

Install update from vendor's website.

References