Manacle Multi-tenant ERP System: SQL injection in API endpoint
Summary
The Multi-tenant ERP System from Manacle Technologies does not sufficiently validate and parameterize user-supplied input in an API endpoint. An unauthenticated remote attacker can send crafted input to this endpoint and perform SQL injection attacks against the system. Because the system is multi-tenant, data of several customers may be exposed or altered if the database is reached.
Affected
- Manacle Technologies Multi-tenant ERP System, affected versions not disclosed by the vendor or CERT-In (unknown)
- Unknown.
Fixed in
- Unknown. No patched version has been published.
Workaround
- The vendor has published no specific mitigation for this CVE.
- Restrict access to the ERP API endpoints to trusted internal networks or VPN only.
- Place a web application firewall in front of the API as an interim control (general practice, not vendor-sourced).
Exploitation
- Not marked as known exploited.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS 0.00325 (low predicted exploitation probability).
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Ask each client whether they use this Manacle ERP system and which version.
- Check whether the ERP API is reachable from the internet; if so, restrict access now.
- Request a fix and written confirmation of affected versions from Manacle Technologies.
- Monitor the CERT-In advisory CIVN-2026-0430 and NVD for updates, as NVD analysis is still deferred.
- Treat same-vendor CVEs (CVE-2026-107104, CVE-2026-107102, CVE-2026-84147) as related risks and assume several serious weaknesses in the product.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT-In CIVN-2026-0430 www.cert-in.org.in
- Hacker-News/Vendor advisory copy (TeamWin) teamwin.in
- CVE-2026-107103 at Hol.org Guard hol.org
- CVE-2026-107103 at VulDB vuldb.com
- CVE-2026-107103 at Intruder CVE Monitor cvemon.intruder.io
- CVE-2026-107103 at Vulners NVD vulners.com
- CVE-2026-107103 at OpenCVE app.opencve.io
- CVE-2026-84149 analysis (Ionix) www.ionix.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:08.
Original description (NVD)
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.