The vulnerability is a classic SQL Injection flaw located in the edit_tecnical_user.php script of Personnel Property Equipment System v1.0. An attacker can inject arbitrary SQL statements when submitting form data, enabling unauthorized retrieval, modification, or deletion of data stored in the application's database. The weakness falls under CWE‑89, allowing attackers to compromise confidentiality, integrity, and potentially availability of the system.

Personnel Property Equipment System version 1.0 sourced from Sourcecodester is affected. No specific vendor or product catalog beyond the CPE string indicates this release. Systems running this version, especially those exposed to web traffic, are at risk.

The CVSS score of 9.8 denotes a critical severity, and the low EPSS of less than 1% suggests that widespread exploitation is unlikely at present, though the flaw remains unpatched and could be actively targeted by determined adversaries. The vulnerability is publicly documented and exploitable remotely over standard web protocols via the /ppes/admin/edit_tecnical_user.php endpoint, requiring only valid form submission credentials or the ability to send crafted HTTP requests.