The vulnerability is a SQL injection that occurs when user input in multiple search filters is not properly neutralized. An authenticated attacker can extract sensitive data belonging to other users or other data that the application itself can access.

The vulnerability affects the STER application provided by Centralny Instytut Ochrony Pracy – Państwowy Instytut Badawczy. Versions prior to 9.5 are impacted; the fix was applied in version 9.5.

The CVSS score of 8.7 indicates a high level of severity, and the vulnerability is not yet listed in the CISA KEV catalog. EPSS data is not available, so the exploitation probability is unknown. The description indicates that the attacker must be authenticated, suggesting the attack vector is local or remote within an authenticated session, rather than unauthenticated exploitation.