External risk intelligence

WeGIA Unauthenticated SQL Injection Leads to Database Compromise

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-55680

WeGIA is described as a web manager for charitable institutions. As a web-based management application, it is commonly deployed as a web server accessible over a network. The vulnerability exists in a web-accessible script, making it a likely target for exposure in deployments where the management interface is accessible via the web.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects WeGIA, a web manager for charitable institutions, allowing unauthenticated attackers to execute arbitrary SQL commands. This could enable them to access or alter sensitive database content, including user credentials and billing information.

Unauthenticated database access and modification.
Impacts sensitive financial and user data.
Confirm relevance and exposure to internal systems.

Attack Path

How an attacker could exploit the issue

An attacker can target the WeGIA web manager by sending unauthenticated requests to a specific script. By manipulating the `codigo` parameter in these requests, an attacker can insert malicious SQL commands that are executed directly by the database. This allows for unauthorized access to sensitive information.

No authentication required.
Malicious SQL in `codigo` parameter.
Database content can be read or modified.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, modification, or deletion of sensitive data within the WeGIA application's database. This could include user credentials and billing information.

Database content, including credentials.
Via unauthenticated POST requests.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world responsibility for WeGIA likely falls to the application owners or the platform team managing the web server infrastructure, with support from network and security teams for exposure assessment. The initial step is to identify all WeGIA instances, confirm their network accessibility and business criticality, and then locate the accountable owner to prioritize and plan remediation.

Application or platform teams own the issue.
Verify WeGIA's network exposure and criticality.
Plan remediation based on identified asset owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WeGIA application?

WeGIA is a web-based management platform designed to help charitable institutions organize their administrative tasks. It typically runs on a web server and handles sensitive operational data, such as billing records and user information, making it a central repository for an organization's internal data.

What does CVE-2026-55680 mean in plain English?

This CVE describes a flaw known as SQL Injection (CWE-89). It occurs when software takes input from a user and inserts it directly into a database command without proper checks. Because the code fails to validate the data, an attacker can input specially crafted text that the database interprets as a command, allowing them to read or change information they are not authorized to see.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted POST request to a specific script in the application. By placing a malicious SQL expression into the 'codigo' parameter, the application incorrectly processes the command. Importantly, this requires no login credentials to execute; however, the attack only works when sent to that specific file path, and requests that do not target this parameter or file will not trigger this vulnerability.

Is my instance of WeGIA at risk?

Halo Surface Signal indicates that because WeGIA functions as a web-accessible management tool, it is frequently deployed on networks where it can be reached via a browser. If your instance is reachable over the internet or an untrusted network, it is more likely to be exposed. You should prioritize assessing whether the web interface is exposed beyond your internal, protected network.

What should I do to address this vulnerability?

First, identify all instances of WeGIA running in your environment and determine who is responsible for managing them. The primary fix is to update your installation to version 3.8.6 or later, which contains the necessary security improvements. Work with your technical team to plan this update while verifying the network accessibility of your existing installations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.