Library CMS 1.0 allows unauthenticated attackers to bypass the admin login by injecting SQL code through the username field. The flaw is a classic SQL injection (CWE-89) that uses Boolean‑based blind payloads to manipulate database queries, enabling an attacker to gain unauthorized access to the CMS and its backend functionality.

The vulnerability affects the Wecodex Library CMS product, version 1.0.

The CVSS score of 8.8 indicates high severity. Although EPSS data is not available and the issue is not listed in the KEV catalog, the attack vector is inferred to be network‑based through POST requests to the admin login endpoint, meaning remote access is possible without prior authentication. Given the high score and the lack of mitigation in the current version, exploitation is considered likely if the system is exposed to the Internet.