SQL Injection in Simple Sa Simple.erp
CVE-2026-1198
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in 6.30@A04.4_u06.
Vulnerability class: SQL Injection
EPSS: 0.003 (23.0th percentile) — read the EPSS interpretation.
Affected products
- Simple Sa Simple.erp — versions 0
Weakness classification (CWE)
References
- cvd@cert.pl (product)
- cvd@cert.pl (third-party-advisory)