A flaw in Kados R10 GreenBee lets attackers insert arbitrary SQL code via the language_tag HTTP parameter. This injection can be used to read confidential database information or alter stored data, compromising both confidentiality and integrity. The vulnerability is a classic example of unchecked input leading to a database query tampering issue marked by CWE-89.

The weakness appears in the Kados R10 GreenBee application, released by Marmotech. No sub‑version details are provided, so all publicly delivered copies of R10 GreenBee running the affected component are at risk. Administrators should verify that their installed instance is the R10 GreenBee version and check for any available patches or newer releases.

The score of 8.8 on the CVSS scale indicates high severity, and an EPSS of less than 1% suggests exploitation is presently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely succeed by sending a crafted HTTP request containing malicious SQL to the language_tag field, assuming the web front‑end is exposed. The path is remote and does not require local or privileged access.