CVE-2026-111700

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/enUS/eql, escaping the unsanitized EqlBuilder SQL...

CVE-2026-111700

The WebVella ERP application (versions through 1.8.8 ) is vulnerable to SQL Injection via the EQL query API . The root cause is the unsanitized SQL interpolation within the EqlBuilder component, where WHERE-clause text literals are not properly neutralized. An authenticated user can exploit this ...

EUVD-2026-102991

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/enUS/eql, escaping the unsanitized EqlBuilder SQL...

PT-2026-116099

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en US/eql, escaping the unsanitized EqlBuilder SQL...