This vulnerability in Talent Software UNIS (versions before 42321) is due to improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). An attacker could exploit this flaw to execute arbitrary SQL commands on the backend database, potentially leading to full compromise of the affected system's data confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on all security properties. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands without authentication, resulting in complete compromise of the affected database and system. This includes unauthorized data disclosure, data modification, and potential denial of service. The vulnerability is rated critical with a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring for unusual database activity and restricting network access to the affected application may help reduce risk, but these are general measures and not specific mitigations. Do not assume the vulnerability is mitigated without vendor confirmation.