CVE Alert: CVE-2026-111700 – WebVella – WebVella

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.

**Risk verdict:** High risk for reachable deployments; prioritise prompt remediation, but urgency cannot be calibrated fully without exploitation and prevalence data.

**Why this matters:** A low-privilege account could potentially extract sensitive records, including identity and role data, enabling privacy breaches and follow-on account targeting. Limited data modification is also possible, while the supplied impact metrics do not indicate direct availability or cross-scope impact. KEV, SSVC, PoC and EPSS indicators are absent, so active exploitation and likelihood remain uncertain.

**Most likely attack path:** An attacker needs network access and a valid account, but no user interaction or complex conditions; they can submit crafted query text to the exposed API. The assessed scope is unchanged, so direct impact is within the affected application, though stolen credentials or role information could support later access elsewhere.

**Who is most exposed:** Internet-accessible ERP deployments with accounts available to customers, partners or large user groups are most at risk. Internal installations remain exposed to compromised or malicious accounts.

Review API access logs for unusual EQL filters, quote escaping or repeated query failures.

Look for unexpected reads of user, role or other sensitive entities.

Correlate suspicious API requests with account logins and subsequent privilege changes.

Mitigation and prioritisation:

Upgrade to a vendor-fixed release; confirm the fix with the maintainer before deployment.

Restrict API access to trusted networks and minimise accounts able to query EQL.

Review database permissions and monitor for abnormal bulk reads.

Check KEV, SSVC and EPSS status; reassess urgency when available, and test changes before production rollout.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.