CVE-2026-59109

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/c5v6qop7aeqi7...

CVE-2026-59109 Zalktis: SQL injection via partner-controlled fields in imported e-invoices

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...