The vulnerability is an SQL injection flaw in the admin login function that allows an attacker to supply malicious SQL through the username field in a POST request. This flaw lets unauthenticated users bypass authentication, read sensitive database data, and obtain administrative privileges. The weakness is a classic input validation error identified as CWE-89.

The affected system is the Wecodex Hotel CMS, version 1.0, sold and maintained by Wecodex. Users running this exact version are exposed.

With a CVSS score of 8.8 the vulnerability is classified as high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, the attack vector is a standard web-based POST request to index.php?action=processlogin, meaning any host with the vulnerable CMS exposed to the internet could be targeted by automated scripts that insert SQL payloads into the username field.