The vulnerability permits an attacker to inject arbitrary SQL through the id_to_modify parameter in Kados R10 GreenBee, allowing extraction of sensitive information or modification of database contents. This flaw is a classic SQL injection (CWE-89) that directly compromises the confidentiality and integrity of data stored by the application.

The affected product is Kados R10 GreenBee from the manufacturer Kados. No specific version information is provided in the available data, and the vulnerability is present in the R10 GreenBee feature set.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score is reported as less than 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via web requests to the vulnerable endpoint carrying a malicious id_to_modify value, executable over the network against an exposed instance of the application.