CVE-2026-107103— SQL Injection Vulnerability in Manacle Technologies ERP System
Quick assessment
Affected
Manacle Technologies Multi-tenant ERP System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
该漏洞存在于 ERP 系统中，原因是 API 端点对用户提供的输入缺乏充分的验证和参数化处理。未认证的远程攻击者可以通过向该易受攻击的端点提供精心构造的输入来利用此漏洞。 成功利用此漏洞将使攻击者能够对目标系统执行 SQL 注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107103
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL Injection Vulnerability in Manacle Technologies ERP System
Source: CVE Program / CVE List V5
Vulnerability Description
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.
Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Manacle Technologies | Multi-tenant ERP System | version | - |
|
II. Public POCs for CVE-2026-107103
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107103
请登录查看更多情报信息。
Other References for CVE-2026-107103 (1)
-
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430 third-party-advisory
Same Patch Batch · Manacle Technologies · 2026-10-07 · 3 CVEs total
| CVE-2026-107102 | 9.3 CRITICAL | Account Takeover Vulnerability in Manacle Technologies ERP System |
| CVE-2026-107104 | 9.3 CRITICAL | Unsafe Deserialization Vulnerability in Manacle Technologies ERP System |
IV. Related Vulnerabilities
Same product: Multi-tenant ERP System
-
CVE-2026-107104
Unsafe Deserialization Vulnerability in Manacle Technologies -
CVE-2026-107102
Account Takeover Vulnerability in Manacle Technologies ERP S -
CVE-2026-84149
Information Disclosure Vulnerability in Manacle Technologies -
CVE-2026-84148
Insecure Direct Object Reference Vulnerability in Manacle Te -
CVE-2026-84147
Remote Code Execution Vulnerability in Manacle Technologies
Same vendor: Manacle Technologies
-
CVE-2026-107104
Unsafe Deserialization Vulnerability in Manacle Technologies -
CVE-2026-107102
Account Takeover Vulnerability in Manacle Technologies ERP S -
CVE-2026-84149
Information Disclosure Vulnerability in Manacle Technologies -
CVE-2026-84148
Insecure Direct Object Reference Vulnerability in Manacle Te -
CVE-2026-84147
Remote Code Execution Vulnerability in Manacle Technologies
Same weakness: CWE-89
-
CVE-2026-42720
WordPress Dynamic User Directory plugin <= 2.4 - SQL Injecti -
CVE-2026-42721
WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection -
CVE-2026-102782
Joomla Extension - ordasoft.com - Unauthenticated SQL inject -
CVE-2026-105856
Payload: SQL injection in SQLite/Postgres -
CVE-2026-105957
SourceCodester Performance Indicator System view_product.php
V. Comments for CVE-2026-107103
No comments yet