The affected Multi-tenant ERP System fails to validate and parameterize user‑supplied data in an API endpoint, enabling a classic SQL injection. An attacker with no authentication can send specially crafted input to that endpoint and execute arbitrary SQL statements against the underlying database. This capability threatens confidentiality, integrity, and availability by allowing data exfiltration, unauthorized modification, or complete compromise of the database.

The vendor is Manacle Technologies, which provides the Multi‑tenant ERP System. The vulnerability is reported to affect all versions of this product; specific version details are not listed in the advisory.

The likely attack vector is an unauthenticated remote attacker sending specially crafted requests to the exposed API endpoint over the network. The CVSS score of 9.3 indicates a critical severity. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified, but the lack of authentication requirement and the high CVSS suggest it could be abused if the endpoint is exposed. The issue is not listed in the CISA KEV catalog, indicating no documented public exploits at this time.