The vulnerability resides in the example Content Management System’s delete.php handler, where an attacker can manipulate the del parameter to inject arbitrary SQL code. This flaw is a classic SQL injection, classified as CWE‑74 (Improper Parsing of Input) and CWE‑89 (SQL Injection). When exploited, the attacker can read, modify, or delete data in the database, potentially compromising the confidentiality, integrity, and availability of the application’s information. The issue permits remote exploitation, meaning an attacker does not need local access to the host machine.

The affected product is code‑projects Content Management System, version 1.0, as identified by the vendor and CPE entries. No additional compatible versions are listed in the available data.

The CVSS base score of 6.9 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits at the time of this analysis. The attacker can exploit the flaw remotely by sending a specially crafted request to /admin/delete.php with a malicious del parameter, which will be executed directly against the back‑end database.