CVE-2026-40285

WeGIA versions prior to 3.6.10, a web management platform for charitable institutions, contain a SQL injection vulnerability in the UsuarioDAO.php file. An improper use of the extract() function combined with inadequate input validation on the cpf_usuario POST parameter allows authenticated attackers to overwrite session-stored user identity and execute arbitrary SQL queries against the database. The vulnerability is classified as HIGH severity with a CVSS score of 8.8. It requires an authenticated user to trigger (low privilege requirement) but no user interaction, operates over the network, and poses significant confidentiality, integrity, and availability risks through direct SQL query manipulation. The attacker can query or modify database contents while impersonating arbitrary users. The vulnerability shows minimal current exploitation risk, with an EPSS score of 0.000390 indicating it ranks higher than only 0.117 percent of known CVEs in terms of exploitation probability. No public exploit code appears readily available, and the vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog or security hotlist. Organizations should nevertheless prioritize upgrading to version 3.6.10 to eliminate this authentication bypass and SQL injection vector.