CVE-2026-111700: WebVella ERP through 1.8.8 SQL Injection via EQL Query API
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/enUS/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WebVella ERP user can exploit it. The attacker needs the ability to send requests to the EQL API endpoint; no user interaction is required.
Which interface and input are affected?
The affected interface is POST /api/v3/en_US/eql. Crafted single-quoted text literals in EQL WHERE clauses can reach unsanitized SQL interpolation.
What could an attacker access?
An attacker can read unauthorized entities through injected SQL, including user and role tables. The provided information indicates high confidentiality impact and limited integrity impact.