The vulnerability is a classic SQL injection flaw that allows an attacker to execute arbitrary SQL statements through the 'search' parameter in the '/search.php' endpoint. Because the input is not sanitized, an attacker can read, create, update, or delete database records, thereby compromising the confidentiality, integrity, and availability of the application’s data.

This flaw affects the Cuantis application across all versions, as indicated by the product listing. No specific version is exempt, so every deployed instance of Cuantis is potentially vulnerable.

With a CVSS score of 9.3 this issue is classified as critical. No EPSS score is available and the vulnerability has not been included in CISA’s KEV catalog, suggesting it may not yet be widely exploited. The attack vector is inferred to be remote through HTTP requests to '/search.php', and an attacker must supply a crafted search string to trigger the injection. Given the high impact and lack of a vendor patch, the risk remains very high until a mitigation is applied.