SQL Injection in WebVella ERP Affects User and Role Data

CVE-2026-111700

What is CVE-2026-111700?

WebVella ERP version 1.8.8 is susceptible to an SQL injection vulnerability within its EQL query API. This issue allows authenticated users to formulate malicious SQL commands by injecting single-quoted literals into the WHERE clause of queries. Such injections enable attackers to circumvent security controls, potentially exposing sensitive data, including user and role tables. The exploitation occurs via crafted requests sent to POST /api/v3/en_US/eql, where unsanitized SQL interpolation can be exploited. Organizations using this version should prioritize remediation to protect against unauthorized data access.

References