SQL Injection Vulnerability in Zalktis Accounting Application
CVE-2026-59109

8.7HIGH

Key Information:

Vendor

Zalktis Programmas (sia "zalktis Programmas")

Status
Zalktis
Vendor
CVE Published:
13 August 2026

What is CVE-2026-59109?

The Zalktis accounting application is vulnerable to SQL injection through improperly sanitized input within trading-partner-controlled fields in received electronic invoices. When importing electronic invoices (UBL/PEPPOL) or e-commerce data, Zalktis incorporates these values directly into SQL statements without employing parameterized queries or proper escaping techniques. This oversight allows malicious actors to manipulate the SQL query logic by breaking out of the string literal, potentially leading to unauthorized data access or manipulation.

Affected Version(s)

Zalktis Windows 0 < 2026.1.586

Zalktis Windows 0 < 2026.2.592

References

https://offseq.com/en/research/zalktis-cve-2026-59109
technical-description
https://cvd.cert.lv/disclosed/vuln-all-631428755
government-resourcepermissions-required

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nils Putniņš, OffSeq (SIA SEQ)
CERT-LV
.