CVE-2026-111700
CVE-2026-111700 · WebVella ERP through 1.8.8 SQL Injection via EQL Query API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
CVSS 7.1 · High · EPSS 0.3%
- Published
- Updated
Affected products and versions
webvella-erp
- Versions
- ≥ 0, ≤ 1.8.8: Affected (semver)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/webvella-erp-eql-text-literal-sql-injection
- https://github.com/WebVella/WebVella-ERP/blob/10315fe844198b8620494f716ed75410cd54bfe6/WebVella.Erp/Eql/EqlBuilder.Sql.cs#L580-L581
- https://github.com/WebVella/WebVella-ERP/blob/10315fe844198b8620494f716ed75410cd54bfe6/WebVella.Erp.Web/Controllers/WebApiController.cs#L64-L74
- https://www.nuget.org/packages/WebVella.Erp/1.8.8
- https://www.vulncheck.com/advisories/webvella-erp-through-1.8.8-sql-injection-via-eql-query-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111700