Description
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed.
This issue was fixed in 6.30@A04.4_u06.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Simple | Simple.ERP | < 6.30@A04.4_u06 | 6.30@A04.4_u06 |
References
- https://simple.com.pl/ product
- https://cert.pl/posts/2026/02/CVE-2026-1198 third-party-advisory