CVE-2026-55684

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...