The vulnerability is a classic SQL injection flaw where an attacker can supply arbitrary SQL through the filter_user_mail parameter. This can allow extraction of sensitive data or alteration of records, potentially compromising the confidentiality and integrity of the system’s database. The weakness matches CWE‑89, a typical string-based injection issue.

Kados R10 GreenBee is affected. No specific firmware or minor version distinctions are listed, so any release of the Kados R10 GreenBee edition may potentially be vulnerable.

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is below 1%, indicating that active exploitation is unlikely at present and it is not listed in the CISA KEV catalog. The attack likely occurs via HTTP requests to endpoints that accept the filter_user_mail parameter, so an attacker who can send requests to the vulnerable system—such as through the web application or a malicious network—could exploit it without needing privileged credentials. The overall risk is high because of the potential for data exposure or modification, but the actual exploitation probability is currently low.