The vulnerability is a lack of input validation in the search functionality of the "Obroty na kontach" window in Simple.ERP. An authenticated user can inject malicious SQL into the query, allowing the attacker to read or modify data in the database. The flaw is an example of CWE‑89, a classic SQL injection weakness that compromises confidentiality, integrity, and potentially availability of the system’s data.

The affected product is Simple.ERP from Simple SA. Versions prior to the 6.30@A04.4_u06 release are vulnerable; the issue was fixed in that specific build. The patch applies to all build versions preceding 6.30@A04.4_u06.

The CVSS base score of 8.6 indicates high severity, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability requires authentication, implying that the attacker must first gain valid credentials. Based on the description, it is inferred that an attacker would log into the system, navigate to the "Obroty na kontach" window and inject a crafted query. The limited EPSS suggests that this is not currently a high‑volume attack but remains a serious threat should credentials be compromised.