Live › vulnerability › CVE-2026-111700
Go to dashboardWebVella ERP through 1.8.8 does not sanitize single-quoted literals in WHERE clauses of its EQL query API, so SQL is injected into queries. An authenticated user can send crafted requests to POST /api/v3/en_US/eql and read entities they should not see, including user and role tables.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of WebVella ERP through 1.8.8 where users hold authenticated accounts, since the flaw is reachable by any logged-in user. Teams running the EQL endpoint exposed to many accounts should prioritize it. unknown for deployments with no authenticated users beyond administrators.
No product ranges from the sources yet.
1.8.8 are affected per the sources./api/v3/en_US/eql containing single quotes in the WHERE clause.1.8.8; the sources do not name a fixed version./api/v3/en_US/eql to trusted users.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
This page as .md · .json · in your agent: get_signal("CVE-2026-111700")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.