Webvella Erp Through 1.8.8 Sql Injection Via Eql Query Api

Back www.vulncheck.com

Webvella Erp Through 1.8.8 Sql Injection Via Eql Query Api

www.vulncheck.com • October 17, 2026

Share: View original

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-111700: SQL Injection Vulnerability in WebVella ERP WebVella ERP version 1.8.8 has a SQL injection vulnerability (CVE-2026-111700) that affects authenticated users. The flaw allows attackers to inject SQL through the EQL query API by sending crafted literals to the endpoint POST /api/v3/en_US/eql. This vulnerability is classified as high risk due to its potential to expose sensitive user and role data. The attack requires network access and a valid account, but no complex conditions or user interaction. Internet-accessible deployments are particularly vulnerable, especially those with accounts available to customers or partners. The vulnerability was disclosed on October 16, 2026, and there are currently no known exploits in the wild. Users are advised to upgrade to a vendor-fixed release and restrict API access to trusted networks. 1 sources 63

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection