What is the CVSS score of EUVD-2026-19495?

EUVD-2026-19495 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-19495?

WeGIA versions 3.6.8 and earlier contain a SQL injection vulnerability that allows authenticated users to execute arbitrary database commands, potentially exposing sensitive donor and beneficiary…. A patch is available.

How to fix or mitigate EUVD-2026-19495?

Within 24 hours: Identify all instances of WeGIA running version 3.6.8 or earlier in your environment and assess current user access. Within 7 days: Apply vendor-released patch to WeGIA version 3.6.9 across all instances and validate patch installation. Within 30 days: Conduct audit of database access logs for the id_memorando parameter in DespachoDAO.php to detect any suspicious SQL activity during the exposure window.

PHP EUVD-2026-19495

| CVE-2026-35395 HIGH

SQL Injection (CWE-89)

2026-04-06 security-advisories@github.com

PHP SQLi Wegia

8.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.9

EUVD ID Assigned

Apr 06, 2026 - 21:22 euvd

EUVD-2026-19495

Analysis Generated

Apr 06, 2026 - 21:22 vuln.today

CVE Published

Apr 06, 2026 - 21:16 nvd

HIGH 8.8

DescriptionCVE.org

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in 3.6.9.

AnalysisAI

SQL injection in WeGIA 3.6.8 and earlier allows authenticated users to execute arbitrary SQL commands through the id_memorando parameter in DespachoDAO.php. The vulnerability affects WeGIA, a web-based management system for charitable institutions, enabling attackers with valid credentials to potentially exfiltrate sensitive donor/beneficiary data, modify records, or compromise database integrity. No public exploit identified at time of analysis, with EPSS data not available for this recent CVE. Vendor-released patch available in version 3.6.9.

Technical ContextAI

WeGIA is a PHP-based web application for managing charitable institutions' operations. The vulnerability exists in the data access object (DAO) layer, specifically in dao/memorando/DespachoDAO.php, where the application constructs SQL queries using unsanitized user input. The id_memorando parameter is extracted directly from PHP's $_REQUEST superglobal without validation or parameterization and concatenated into SQL statements. This is a classic CWE-89 SQL injection flaw where untrusted data flows directly into database queries. PHP's $_REQUEST array aggregates GET, POST, and COOKIE data, expanding the attack surface. The lack of prepared statements or input sanitization allows authenticated attackers to break out of the intended query structure and inject arbitrary SQL commands, potentially leveraging database-specific functions or stored procedures.

RemediationAI

Upgrade immediately to WeGIA version 3.6.9, which contains the vendor-released patch addressing this SQL injection vulnerability. The fix should implement parameterized queries or prepared statements in dao/memorando/DespachoDAO.php to prevent SQL injection. Organizations unable to upgrade immediately should implement compensating controls including web application firewall (WAF) rules to detect SQL injection patterns in id_memorando parameters, restrict database permissions for the application user to minimum necessary privileges, and enhance authentication logging to detect anomalous query patterns. Review application logs for suspicious id_memorando values containing SQL keywords or special characters to identify potential exploitation attempts. The vendor security advisory with full details is available at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-43jm-pcrq-w7gv. As this vulnerability requires authentication, ensure strong password policies and monitor for compromised accounts.