CVE-2026-35395: Wegia

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in 3.6.9.

Affected products

• Wegia Wegia: before 3.6.9 (fixed in 3.6.9)

Published 2026-04-06. Last modified 2026-07-24.