CVE-2026-35395: WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in 3.6.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIA (Web gerenciador para instituições assistenciais)to a version that resolves this vulnerability.Fixed in 3.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35395?
CVE-2026-35395 is considered a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2026-35395?
To fix CVE-2026-35395, upgrade WeGIA to version 3.6.9 or later.
What impact does CVE-2026-35395 have on my system?
CVE-2026-35395 allows an attacker to execute arbitrary SQL queries, potentially compromising the database.
Is CVE-2026-35395 still exploitable if I have patched my system?
No, if your system is updated to version 3.6.9 or later, CVE-2026-35395 should no longer be exploitable.
Where is the vulnerability located in the WeGIA software for CVE-2026-35395?
The vulnerability is located in the DespachoDAO.php file, specifically in the processing of the id_memorando parameter.