SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor