CVE-2026-1198CWE-89
SQL Injection in SIMPLE.ERP
High · published February 26, 2026
What it is
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed.
This issue was fixed in [email protected]_u06.
The record
Technical detail
- CVSS v4.0
- 8.6 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00299 · 21.4th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2026-02-26T11:27Z
EPSS history
Timeline