The vulnerability is a classic SQL injection flaw located in the /ppes/admin/myitem_reuse.php endpoint of Personnel Property Equipment System v1.0. It allows a malicious actor to inject arbitrary SQL statements, potentially enabling unauthorized data disclosure, modification, or even privilege escalation on the underlying database. The weakness is identified as CWE-89, reflecting a failure to properly escape or parameterize user-supplied input. This flaw can undermine both the confidentiality and integrity of enterprise data.

Personnel Property Equipment System (version 1.0) developed by Jon Remus Sevellejo is affected. No other versions or vendors are listed as impacted.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. It is likely exploitable via authenticated web requests to the vulnerable PHP script, though no specific authentication requirement is described in the data. Attackers would need network access to the web server and could trigger the flaw by submitting crafted input through the relevant endpoint.