CVE-2026-1198

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in 6.30@A04.4_u06.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Simple SA	Simple.ERP	< 6.30@A04.4_u06

References

Timeline

Published: Feb 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-119807.3IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.CVE-2026-1198004.3Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_content CVE-2026-119814.3The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing CVE-2026-1198167.8Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.CVE-2026-1198177.8Double free in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-1198187.8Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.CVE-2026-119825.1Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.CVE-2026-1198217.8Improper authorization in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.CVE-2026-1198227.0Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevat CVE-2026-1198236.8Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to execute code with a physical attack.CVE-2026-1198248.8Missing authentication for critical function in Remote Desktop Client allows an unauthorized attacker to perform tampering over a network.CVE-2026-1198255.5Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.