CVE-2026-111700 WebVella CVE debrief

Who should care

Defenders and security teams responsible for WebVella ERP deployments should assess exposure and prioritize remediation. Security teams and vulnerability management teams should verify exposure, assess inventory for WebVella ERP 1.8.8 or older, and monitor for suspicious EQL query API activity.

Why it matters

CVE-2026-111700 is a high-severity SQL injection vulnerability in WebVella ERP that allows authenticated users to inject malicious SQL, potentially leading to unauthorized data access. Defenders should prioritize verifying exposure, assessing inventory, and monitoring for suspicious activity.

• Potential unauthorized data access through SQL injection
• Possible lateral movement within compromised systems
• Required verification of WebVella ERP version and exposure
• Necessity for enhanced monitoring of EQL query API activity

Technical summary

The WebVella ERP EQL query API is vulnerable to SQL injection via WHERE-clause text literals. Attackers can inject SQL by sending crafted single-quoted literals to POST /api/v3/en_US/eql, allowing them to read unauthorized entities. WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. This vulnerability allows attackers to send crafted requests and escape unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.

Defensive priority

Defenders should prioritize verifying exposure, assessing inventory for WebVella ERP 1.8.8 or older, and monitoring for suspicious EQL query API activity.

Recommended defensive actions

• Verify WebVella ERP version and assess exposure
• Monitor EQL query API activity for suspicious requests
• Implement input validation and sanitization for EQL queries
• Restrict access to EQL query API for authenticated users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in WebVella ERP through 1.8.8. The NVD entry is currently HIGH with a CVSS score of 7.1. WebVella ERP contains an SQL injection vulnerability through 1.8.8 that allows any authenticated user to inject SQL via WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables. Defenders

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.