A SQL injection flaw exists in Genesys Latitude version 25.1.0.420 where unsanitized user‑supplied input is concatenated directly into SQL statements. An attacker who can authenticate to the application can craft input that is executed by the backend database, allowing the execution of arbitrary SQL queries. This can lead to unauthorized data exfiltration, tampering, or deletion, compromising both confidentiality and integrity of the stored information.

The vulnerability affects the Genesys Latitude product, specifically released as version 25.1.0.420. No other vendors or product variants are identified in the current data set.

The CVSS score of 8.8 denotes a high severity risk, and the EPSS score of less than 1% indicates that exploitation is currently unlikely but possible. The vulnerability is exploitable by authenticated users, and because it allows arbitrary SQL execution, the potential impact is significant. The attack is likely carried out through the application's authenticated interface, requiring valid credentials with sufficient privilege to submit queries to the database. The KEV listing is not present, suggesting that widespread exploitation has not yet been observed, but the high severity of the flaw warrants immediate attention.