A SQL injection flaw exists in Genesys Latitude version 25.1.0.420 where unsanitized user‑supplied input is concatenated directly into SQL statements. An attacker who can authenticate to the application can craft input that is executed by the backend database, allowing the execution of arbitrary SQL queries. This can lead to unauthorized data exfiltration, tampering, or deletion, compromising both confidentiality and integrity of the stored information.

The vulnerability affects the Genesys Latitude product, specifically released as version 25.1.0.420. No other vendors or product variants are identified in the current data set.

No public CVSS score is provided, and EPSS information is unavailable, but the vulnerability is known to be exploitable by authenticated users. Because the flaw allows arbitrary SQL execution, the potential impact is significant. The attack is likely carried out through the application's authenticated interface, and it requires the attacker to have valid credentials with sufficient privilege to submit queries to the database. The absence of a KEV listing suggests that widespread exploitation has not yet been observed, yet the high severity inherent to SQL injection warrants immediate attention.