CVE Intelligence

WebVella vulnerabilities

🔔 Create alert RSS

Published CVEs affecting WebVella products: 1 record(s), with severity, exploitation and fixes.

WebVella-ERP 1

Exploited only (KEV) →

CVE-2026-111700 High · 7.1 CWE-89 Oct 16, 2026
WebVella ERP through 1.8.8 SQL Injection via EQL Query API
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.