Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-59109 SQL Injection in Zalktis Accounting Application via E-Invoice Import https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-59109
Post summary
The text announces a new SQL injection vulnerability (CVE‑2026‑59109) affecting Zalktis Accounting Application during e‑invoice import, without providing PoC, exploit, or patch details.