CVE-2026-23723
Published: 16 January 2026
Summary
CVE-2026-23723 is a high-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app endpoint directly enables exploitation of public-facing application (T1190) and database data access/exfiltration (T1213.006).
NVD Description
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary…
more
file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
Deeper analysisAI
CVE-2026-23723 is an authenticated SQL injection vulnerability (CWE-89) affecting WeGIA, an open-source web manager for charitable institutions, in versions prior to 3.6.2. The flaw resides in the Atendido_ocorrenciaControle endpoint, where the id_memorando parameter fails to properly sanitize user input, enabling malicious SQL queries. It has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
An attacker with high-privilege authenticated access, such as an administrative user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows full database exfiltration, exposure of sensitive personally identifiable information (PII), and potential arbitrary file reads on the server in misconfigured environments.
The vulnerability is addressed in WeGIA version 3.6.2, as detailed in the project's GitHub security advisory (GHSA-xfmp-2hf9-gfjp), the corresponding pull request (pull/1333), and the release notes. Security practitioners should urge affected organizations to upgrade immediately to mitigate risks.
Details
- CWE(s)