CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-55681 WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit idproduto to web/html/matPat/restaurarprodutodesocultar.php, where a second extract$REQUEST overwrites the value previously sanitized by intval. The...

CVE-2026-55681 WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit idproduto to web/html/matPat/restaurarprodutodesocultar.php, where a second extract$REQUEST overwrites the value previously sanitized by intval. The...

CVE-2026-55680 WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastrocobranca.php can place a quoted SQL expression in the codigo parameter, which extract$REQUEST passes into the WHERE codigo= clause of an UPDATE statement without...

CVE-2026-55680

The WeGIA web manager for charitable institutions is vulnerable to an unauthenticated SQL injection in the web/html/socio/sistema/cadastro_cobranca.php component. The root cause is the lack of validation or parameter binding when processing the codigo parameter via extract($_REQUEST), allowing an...

CVE-2026-55680 WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastrocobranca.php can place a quoted SQL expression in the codigo parameter, which extract$REQUEST passes into the WHERE codigo= clause of an UPDATE statement without...

CVE-2026-55683

The WeGIA web manager for charitable institutions contains an SQL Injection vulnerability in the web/html/socio/sistema/cadastro_cobranca.php endpoint. Prior to version 3.8.6 , the application fails to use prepared statements when processing POST input via extract($_REQUEST). Specifically, the pa...

CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-55386 InvoiceShelf ORDER BY SQL injection through orderByField

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without...

EUVD-2026-101587

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without...

CVE-2026-55386 InvoiceShelf ORDER BY SQL injection through orderByField

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without...

CVE-2026-104143

Prior to version 2.10.26 , the DataEase data visualization tool is vulnerable to a Stored SQL Injection . Authenticated users can provide a crafted dateFormat for a dataset field, which is inserted without validation into date conversion templates (including Dimension2SQLObj and Field2SQLObj). In...

CVE-2026-104143 DataEase: Stored SQL Injection via dateFormat field templates

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str...

CVE-2026-104142 DataEase: Stored SQL Injection in group-field binning bounds

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts...

CVE-2026-104142

DataEase, an open source data visualization and analysis tool, is vulnerable to a stored SQL injection in its dataset group-field binning definitions prior to version 2.10.26 . Authenticated users can submit crafted values for FieldGroupDTO.min , FieldGroupDTO.max , FieldGroupDTO.startTime , or F...

CVE-2026-104142 DataEase: Stored SQL Injection in group-field binning bounds

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts...

CVE-2026-104141 DataEase: SQL Injection in datasource metadata identifiers

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...

CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...