CVE-2026-55684

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro cobrancas geracao.php endpoint accepts form-encoded POST data through extract($ REQUEST) and interpolates codigo, descricao, data emissao, data vencimento, data pagamento, valor, valor pago, status, link cobranca, link boleto, linha digitavel, and id socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.