The vulnerability is an out‑of‑band SQL injection (OOB SQLi) that occurs when an attacker supplies specially crafted input in the parameters ‘Id_usuario’ or ‘Id_evaluacion’ on the /evaluacion_hca_evalua.aspx page of the Quatuor performance evaluation application. Because the application does not filter or encode the data, the attacker can force the database to send query results to an external location controlled by the attacker, thereby exfiltrating sensitive information without the application returning it directly to the user. The weakness is a classic SQL injection flaw (CWE‑89) that compromises the confidentiality of stored data.

Quatuor: Evaluación de Desempeño (EDD) is the product affected. The CVE does not list specific full‑patch versions, but the vendor has released an updated version on November 12, 2025 that resolves the issue. The vulnerability applies to the base application prior to that release.

The CVSS score of 9.3 indicates high severity. The EPSS score of less than 1% suggests that exploitation attempts are very rare at present, and the vulnerability is not noted in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the public web interface, with an attacker needing only to craft a request to the identified endpoint. The attack requires the application to be reachable and the input parameters not to be otherwise protected by authentication or validation. Once triggered, the attacker can acquire database contents through the OOB channel.