SQL Injection affecting the Access Manager role allows an attacker to execute arbitrary SQL statements against the database. The flaw is a classic injection point (CWE-89) that can result in unauthorized data disclosure or modification if exploited. Any sensitive information or system configuration values stored in the database could be accessed or altered by an attacker who can trigger the injection.

Genetec Security Center from Genetec Inc. is affected. Specific product versions are not listed in the data, but the vulnerability is documented in the security update references for Security Center 5.12.2.17 and 5.13.3.5. No other vendors or products are reported.

The vulnerability has a CVSS score of 6.6, indicating a moderate severity level. The EPSS score is not available and the entry is not listed in the CISA KEV catalog, so the current exploitation probability is unclear. The likely attack vector involves the web-based Access Manager interface or API where role-based queries are constructed without proper input validation. If an attacker can reach this component, they can retrieve or modify data, compromising confidentiality and integrity of the system.