{"id":"CVE-2026-107103","state":"PUBLISHED","title":"SQL Injection Vulnerability in Manacle Technologies ERP System","description":"This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.","publishedAt":"2026-10-07T08:21:22.512Z","updatedAt":"2026-10-07T18:07:23.030Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"CERT-In"},"assigner":"CERT-In","products":["Manacle Technologies Multi-tenant ERP System"],"affected":[{"vendor":"Manacle Technologies","product":"Multi-tenant ERP System","defaultStatus":"unaffected","versions":[{"version":"version","status":"affected"}]}],"references":["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/107xxx/CVE-2026-107103.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-107103","state":"PUBLISHED","datePublished":"2026-10-07T08:21:22.512Z","dateUpdated":"2026-10-07T18:07:23.030Z","assignerShortName":"CERT-In","assignerOrgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateReserved":"2026-10-07T06:16:49.039Z"},"containers":{"cna":{"title":"SQL Injection Vulnerability in Manacle Technologies ERP System","descriptions":[{"lang":"en","value":"This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system."}],"affected":[{"vendor":"Manacle Technologies","product":"Multi-tenant ERP System","defaultStatus":"unaffected","versions":[{"version":"version","status":"affected"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-In","orgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateUpdated":"2026-10-07T08:21:22.512Z"},"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:version:*:*:*:*:*:*:*"}]}]}],"solutions":[{"lang":"en","value":"Contact Manacle Technologies for the patched version.","supportingMedia":[{"type":"text/html","base64":false,"value":"Contact Manacle Technologies for the patched version."}]}],"credits":[{"lang":"en","value":"This vulnerability is reported by Nisarga Adhikary.","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-07T18:07:03.551948Z","id":"CVE-2026-107103","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-07T18:07:23.030Z"}}]}}}