WebVella ERP CVE-2026-111700

Requires a valid authenticated WebVella ERP account at any privilege level and network access to the EQL query API endpoint (POST /api/v3/en_US/eql). The specific trigger is a crafted single-quoted text literal placed in a WHERE clause, which escapes EqlBuilder's unsanitized SQL string interpolation. No user interaction and no non-default configuration are needed because the EQL API is core product functionality; the primary limiting factor is the authentication requirement (PR:L), meaning this cannot be exploited by fully unauthenticated attackers.

This is a genuine but moderate-priority issue, not an overstated high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, score 7.1) is internally consistent with the description: network-reachable, low-complexity SQL injection in the EQL query API that any authenticated low-privilege user can trigger without user interaction, yielding high confidentiality impact (reading unauthorized entities including user and role tables) but only low integrity and no availability impact. The key limiting signal is PR:L - exploitation requires a valid authenticated account, so this is not a pre-auth internet-wide threat and is better characterized as a privilege-escalation / unauthorized-data-access flaw usable by any legitimate or compromised low-privilege user. No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV; there is no evidence of active exploitation. A detailed public technical writeup (hackmd) and VulnCheck advisory exist with exact vulnerable source lines, which materially lowers the effort to develop a working exploit, but no weaponized public exploit code is confirmed in the provided data. Net: credible, easily exploitable post-authentication, but scoped by the authentication requirement and the niche footprint of the product.

An attacker with any authenticated WebVella ERP account (or a compromised low-privilege user) sends a POST request to /api/v3/en_US/eql containing a crafted single-quoted text literal in a WHERE clause. Because EqlBuilder performs unsanitized string interpolation, the attacker escapes the intended literal and injects arbitrary SQL, reading entities they should not access such as user and role tables. A detailed public technical writeup documents the exact vulnerable code path, so exploit development is low-effort even though no packaged public exploit is confirmed.