The Notes_controller::search_scratch_data function concatenates the untrusted field_name parameter into an SQL query, creating a classic SQL injection vulnerability. This flaw, categorized as CWE-74 and CWE-89, permits an attacker to inject arbitrary SQL statements. Since the vulnerable endpoint is reachable remotely, attacks can be launched without prior authentication, potentially compromising data stored in the backing database.

Any installation of mjperpinosa/stumasy that incorporates the Notes_controller::search_scratch_data feature and has not migrated beyond the commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be is susceptible. Because the project follows a rolling‑release model, no specific version numbers are listed; therefore, every current release prior to an official fix should be treated as at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1 %, suggesting a low probability of widespread exploitation but the existence of publicly available exploit code removes that as a vulnerability is not yet catalogued in the CISA KEV list. Attackers can access the vulnerable endpoint from any network location, and without a patch, the risk remains until a fix is applied.