The vulnerability is an out‑of‑band SQL injection (OOB SQLi) discovered in the Performance Evaluation (EDD) application. By manipulating the 'txAny' parameter on the '/evaluacion_competencias_autoeval_list.aspx' page, an attacker can extract sensitive database data via external channels. Because the database content is not returned directly by the application, the primary impact is confidentiality violation. The flaw is a classic SQL injection problem, classified as CWE‑89.

The affected system is the Quatuor Evaluación de Desempeño (EDD) application. All releases published before the November 12, 2025 upgrade are vulnerable; the security team has confirmed that the issue is fixed in the latest release available from Quatuor.

The CVSS score of 9.3 indicates high severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. To exploit it, an attacker must send a crafted request to the '/evaluacion_competencias_autoeval_list.aspx' endpoint, supplying a malicious value in the 'txAny' parameter. The affected endpoint is publicly reachable, so the attack vector is remote over the network.