CVE-2026-107103CWE-89sql-injection

CVE-2026-107103

published October 7, 2026

CVSS
9.3
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.

Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00325 · 24.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-07T13:17Z
References (1)
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430 · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 07 OCT 08:21Z
    SQL Injection Vulnerability in Manacle Technologies ERP System
    cvelistv5