An SQL injection flaw exists in the search.php component of the code-projects Content Management System, allowing an attacker to manipulate the Value argument and execute arbitrary SQL queries against the back‑end database. The vulnerability can enable unauthorized reading, modification, or deletion of data, compromising the confidentiality, integrity, and possibly the availability of the system’s data store. The weakness falls under CWE‑89 and represents a classic web‑application injection flaw.

The flaw is present in code‑projects Content Management System version 1.0 and may affect any deployment that has not incorporated a later, patched release. The vulnerability occurs in the search.php file and is tied to the unfiltered Value parameter used in database queries.

The CVSS score of 6.9 indicates a medium‑high severity, with a low probability of exploitation (EPSS < 1%) and no listing in the CISA KEV catalog. The attack vector is remote, requiring the attacker to issue crafted HTTP requests containing malicious SQL statements against the search endpoint, which can be performed from outside the network without authentication. The risk is heightened in environments that expose the search functionality to untrusted users or the internet.