Skip to main content

Manacle ERP CVE-2026-107103

| EUVDEUVD-2026-94218 CRITICAL
SQL Injection (CWE-89)
2026-10-07 CERT-In GHSA-v93j-gmfc-9m25
SQLi Multi Tenant Erp System Manacle Technologies
9.3
CVSS 4.0 · Vendor: CERT-In
Share

Severity by source

Vendor (CERT-In) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Unauthenticated network-reachable endpoint gives AV:N/AC:L/PR:N/UI:N; SQL injection permits reading and modifying database data (C:H/I:H), with no availability impact described (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-In).

CVSS VectorVendor: CERT-In

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Oct 07, 2026 - 09:05 vuln.today
CVE Published
Oct 07, 2026 - 08:21 cve.org
CRITICAL 9.3

DescriptionCVE.org

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.

Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.

AnalysisAI

Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions beyond network reachability to the vulnerable API endpoint - the CVSS vector (PR:N/UI:N/AC:L/AT:N) and description confirm remote, unauthenticated exploitation requiring only crafted input to the affected endpoint of the Manacle Multi-Tenant ERP System. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) describes a network-reachable, low-complexity, unauthenticated SQL injection with high confidentiality and integrity impact, which is consistent with the description of an unauthenticated remote attacker sending crafted input to an API endpoint - the signals do not conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch was identified at time of analysis, so the immediate priority is reducing reachability and hardening query handling. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, restrict external reachability of the Multi-Tenant ERP System API endpoint to trusted networks or VPN only, deploy web application firewall rules tuned to block SQL injection patterns against that endpoint, and enable verbose database and API query logging with alerting on anomalous SQL syntax or unusual query volume; treat this as an emergency containment action because no vendor-released patch is identified at time of analysis. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Multi Tenant Erp System

View all
CVE-2026-84147 CRITICAL
10.0 Sep 01

Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitr
CVE-2026-107104 CRITICAL
9.3 Oct 07

Unauthenticated remote code execution in Manacle Multi-Tenant ERP allows attackers to execute arbitrary code or manipula
CVE-2026-107102 CRITICAL
9.3 Oct 07

Unauthenticated authentication bypass in Manacle Technologies' Multi-Tenant ERP System lets a remote attacker forge paym
CVE-2026-84149 CRITICAL
9.2 Sep 01

Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to recon
CVE-2026-84148 CRITICAL
9.2 Sep 01

Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to re

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-107103 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy