CVE Intelligence

WebVella WebVella-ERP vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting WebVella WebVella-ERP: 1 record(s), with affected versions and fixes.

CVE-2026-111700 High · 7.1 CWE-89 Oct 16, 2026
WebVella ERP through 1.8.8 SQL Injection via EQL Query API
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.