CVE-2026-55679

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-55679

The WeGIA web manager for charitable institutions is vulnerable to a pre-authentication installer injection chain in versions prior to 3.8.6 . The vulnerability exists because the web/instalador/instalador.php endpoint processes unauthenticated POST data before config.php is created. In the Linux...

CVE-2026-55679

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-55679 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

EUVD-2026-101621

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-55679 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-55679 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

PT-2026-114218

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.6 Description The pre-installation endpoint "web/instalador/instalador.php" is accessible before the config.php file is created and processes unauthenticated POST data. During the Linux reinstall process, a speciall...