CVE-2026-111700 is a high severity (CVSS 7.1) SQL injection in WebVella ERP through 1.8.8. Any authenticated user can inject SQL through text literals in the EQL query API and read tables they should not, including users and roles. The record names no fixed version.
What's affected
WebVella ERP 1.8.8 and earlier, per the record and VulnCheck. The record points to the EQL endpoint at /api/v3/en_US/eql and the EqlBuilder code that interpolates text literals into SQL. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The attacker must be signed in, but the record says any authenticated user qualifies, so low privilege accounts count.
Scoring note: the record's 7.1 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.1 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm the WebVella ERP version. Review accounts with access to the EQL API and consider who truly needs it.
In application and database logs, look for EQL requests with unusual quoting inside WHERE clause literals, and for queries against user or role entities from accounts that do not normally read them.
What to do now
- Inventory deployments and versions.
- Limit the EQL API to the few accounts that need it.
- Audit queries to user and role entities for unexpected readers.
- Rotate passwords and API keys for accounts that may have been exposed.
- Run the database account with least privilege.
- Upgrade once a confirmed fix is published.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-89, SQL injection. EQL is a query language the product translates into SQL. The translator copies text literals into the generated statement without escaping them, so a quote character in user input can end the literal and add SQL of its own.
This shows why query builders deserve the same care as hand written SQL. A layer that looks safe still needs parameter binding underneath. The record notes that user and role tables can be read, which turns a data bug into a credential exposure. It is not listed in CISA KEV.
Quick check
Does the attacker need admin rights?
No. The record says any authenticated user can reach the flaw.
Where is the weakness?
In the code that converts EQL text literals into SQL without escaping them.
Sources
Last reviewed: 18 October 2026.
