CVE-2026-111700: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WebVella WebVella-ERP

CVE-2026-111700 describes an SQL injection vulnerability in WebVella ERP through version 1.8.8. The flaw exists in the EQL query API endpoint POST /api/v3/en_US/eql, where user-supplied single-quoted literals in the WHERE clause are not properly sanitized before being interpolated into SQL statements by the EqlBuilder. This allows authenticated users to inject arbitrary SQL commands, enabling unauthorized reading of sensitive entities including user and role tables. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An authenticated attacker can exploit this vulnerability to perform SQL injection attacks, potentially reading unauthorized data from the database such as user and role information. This could lead to information disclosure and compromise of sensitive data within the WebVella ERP system. There is no indication of privilege escalation or remote code execution in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the EQL query API to trusted users only and monitor for suspicious activity involving the POST /api/v3/en_US/eql endpoint. Avoid exposing the vulnerable API to untrusted networks.