GestSup versions earlier than 3.2.60 allow an authenticated user to inject arbitrary SQL through the search input field. The input is incorporated into database queries without sufficient neutralization, enabling the attacker to access or modify table data depending on the privileges granted to the database account. This flaw falls directly under the SQL Injection weakness (CWE‑89).

The vulnerability affects all installations of GestSup, product name GestSup, in any environment where the search bar is enabled and the user has authenticated access. Versions older than 3.2.60 are vulnerable; upgrading to 3.2.60 or later disables the flaw.

The CVSS score of 7.7 indicates a high severity for confidentiality, integrity, and availability. The EPSS score of less than 1% suggests the probability of exploitation is low at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated session and access to the web interface; exploitation is straightforward once the conditions are met, allowing an attacker to read or alter database contents.