The application includes a time‑based blind SQL injection vulnerability in the loginaction.php script, within the Email input field, that allows an attacker to execute arbitrary SQL statements. This flaw is a classic injection (CWE-89) and could enable an unauthenticated user to extract sensitive database contents, compromising confidentiality and potentially providing a foothold for further attacks.

The vulnerability affects Netartmedia Event Portal 2.0, as identified in the product list. No sub‑version details were provided, so all installations of this product that contain the loginaction.php file are potentially vulnerable.

The CVSS base score is 8.8, classifying the flaw as high severity. The EPSS score indicates a low exploitation probability (<1%), and the vulnerability does not appear in the CISA KEV catalog. The attack vector is inferred to be remote, via unauthenticated HTTP POST requests to loginaction.php with crafted Email payloads; exploitation requires monitoring time delays to infer database information.