ScadaLTS version 2.8.1-release-candidate build 0 contains an authenticated blind SQL injection vulnerability in the /api/events/search endpoint. Authenticated users with the ROLE_USER role or higher can exploit this flaw by sending a crafted JSON body with a sortBy array that is unsafely concatenated into the SQL ORDER BY clause. This vulnerability allows extraction of arbitrary database data, including user password hashes, without requiring user interaction.