CVE-2026-35395 LabRedesCefetRJ CVE debrief

Who should care

Administrators and users of WeGIA versions prior to 3.6.9 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system deployments, validating affected scope, and planning vendor-supported updates or mitigations. Security teams should monitor for suspicious database activity and implement additional security measures to prevent exploitation.

Technical summary

The CVE-2026-35395 vulnerability is a SQL injection vulnerability in the WeGIA web manager for charitable institutions. The vulnerability exists in the dao/memorando/DespachoDAO.php file, where user input is not properly validated before being used in SQL queries. This allows authenticated users to execute arbitrary SQL commands, potentially leading to data breaches or system compromise. The vulnerability has a CVSS score of 8.8 and is considered high severity. The vulnerability is fixed in version 3.6.9.

Defensive priority

High

Recommended defensive actions

• Upgrade to WeGIA version 3.6.9 or later
• Validate and sanitize user input to prevent SQL injection
• Monitor for suspicious database activity
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-35395 vulnerability was reported by an unknown source and is described in the NVD database. WeGIA, a web manager for charitable institutions, contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. The vulnerability is fixed in version 3.6.9. Evidence is limited, and defenders should verify affected scope and vendor guidance.

Official resources