WeGIA EUVD-2026-101619

No special conditions - remote unauthenticated exploitation against default configurations of WeGIA versions prior to 3.8.6. The vulnerable endpoint web/html/socio/sistema/cadastro_cobranca.php requires no authentication and no user interaction, and accepts injectable input (valor, valor_pago, id_pessoa, id_socio, id_sociotipo) via POST through extract($_REQUEST). The only meaningful limiting factors are that the WeGIA instance must be network-reachable by the attacker and must be running a version below 3.8.6; upgrading to 3.8.6 (which introduces prepared statements and integer/float filtering) fully removes the condition.

All available signals point to a genuine high-priority vulnerability rather than an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the description independently corroborates this: the vulnerable cadastro_cobranca.php endpoint is explicitly unauthenticated and takes attacker-controlled POST input via extract($_REQUEST) straight into UPDATE/INSERT/SELECT statements with no prepared statements (CWE-89). The source-code commit diff confirms the root cause and the fix (migration to mysqli_prepare with bound parameters), so the technical claim is strongly substantiated. Signals are internally consistent - there is no network-vs-local contradiction here. The limiting factors are external to the bug itself: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC flag was supplied, so there is no evidence of active or at-scale exploitation. The dominant risk-reducer is product prevalence: WeGIA is a niche charity-management application, so real-world blast radius is small even though per-instance impact is severe. Net assessment: critical technical severity and trivially exploitable on any exposed instance, but prioritize based on whether your organization actually runs WeGIA rather than treating this as a broadly scanned internet-wide threat.

A remote, unauthenticated attacker locates an internet-exposed WeGIA instance (prior to 3.8.6) and sends a crafted POST request to web/html/socio/sistema/cadastro_cobranca.php, injecting SQL through the valor, valor_pago, id_pessoa, id_socio, or id_sociotipo parameters. Because input flows through extract($_REQUEST) into unparameterized queries, the attacker can read billing records and stored credential data, tamper with payment amounts, or DROP/TRUNCATE tables to destroy application data. No public exploit identified at time of analysis, but the confirmed commit diff makes the vulnerable code path fully transparent to any attacker.