The M‑Plus edition of the Matri4Web Matrimony Website Script contains several unsanitized POST parameters that enable attackers to inject arbitrary SQL code. Unauthenticated users can supply malicious payloads in fields such as txtGender, religion, Fage, and cboCountry across numerous result pages and the registration script. Because the script directly interpolates these values into database queries, attackers could extract sensitive user data or execute arbitrary SQL commands, leading to data theft or modification.

The affected application is the Matri4Web Matrimony Website Script, version information is not supplied in the advisory. The vulnerability exists in the result‑generation and registration components (simplesearch_results.php, advsearch_results.php, specialcase_results.php, locational_results.php, registration2.php). Users running any deployment of this script are potentially exposed unless they have applied a vendor update.

The CVSS score is 8.8, indicating high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication requirements makes exploitation straightforward over the Internet. Attackers likely use standard web‑based POST requests to deliver the payload, which can immediately compromise confidentiality and integrity of the underlying database.