Description
WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exists in the WeGIA application. The remover_produto_ocultar.php script uses extract($_REQUEST) to populate local variables and then directly concatenates these variables into a SQL query executed via PDO::query. This allows an authenticated (or auth-bypassed) attacker to execute arbitrary SQL commands. This can be used to exfiltrate sensitive data from the database or, as demonstrated in this PoC, cause a time-based delay (denial of service). This vulnerability is fixed in 3.6.6.
INFO
Published Date :
2026-03-11T19:10:32.383Z
Last Modified :
2026-03-12T20:03:11.859Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-31896 vulnerability.
| Vendors | Products |
|---|---|
| Labredescefetrj |
|
| Wegia |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-31896.
