{"affected":[{"defaultStatus":"unaffected","product":"WhatsApp for Dolibarr","source":"CNA: INCIBE","vendor":"Sgestion / EasySoft","versions":[{"status":"affected","version":"1.9"}]}],"cveId":"CVE-2026-76173","cwes":["CWE-89"],"description":"Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794475438431,"publishedAt":1794475438431,"references":[{"source":"CNA: INCIBE","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft"}],"remediation":[{"kind":"fix","source":"CNA: INCIBE","text":"The manufacturer has confirmed that the patch addressing the vulnerability has already been deployed."}],"revision":"001231a2594ba43cd19f7a1cb123bb8fddb4232c802572d9990c442b14b891ab","sources":[{"modifiedAt":1794475438431,"name":"CNA: INCIBE","retrievedAt":1794478146221,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76173"}],"ssvc":null,"status":"published","title":"SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft","updatedAt":1794478146221}