Zalktis
Monthly
SQL injection in Zalktis accounting software allows an external trading partner to execute arbitrary database queries by embedding malicious payloads in electronic invoice fields (UBL/PEPPOL format). Versions before 2026.1.586 (v1 branch) and 2026.2.592 (v2 branch) concatenate partner-controlled invoice field values directly into SQL statement text, bypassing the application's own Dazadi.sql_txt() escaping helper on the e-invoice and e-commerce import code paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack surface is inherent to the standard business workflow of receiving and importing invoices from counterparties.
SQL injection in Zalktis accounting software allows an external trading partner to execute arbitrary database queries by embedding malicious payloads in electronic invoice fields (UBL/PEPPOL format). Versions before 2026.1.586 (v1 branch) and 2026.2.592 (v2 branch) concatenate partner-controlled invoice field values directly into SQL statement text, bypassing the application's own Dazadi.sql_txt() escaping helper on the e-invoice and e-commerce import code paths. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the attack surface is inherent to the standard business workflow of receiving and importing invoices from counterparties.