CVE-2026-23723 — WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via t…
Published: 2026-01-16 · CVSS: 7.2 · CVSS 3.1
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7