The vulnerability is a classic SQL injection flaw caused by the unsanitized use of the fname argument in the processprofile_form function of the profile creation endpoint. An attacker can inject arbitrary SQL code through this field, allowing them to read, modify, or delete database records and potentially gain broader system compromise. The weakness is expressed by CWE‑74 (Improper Neutralization of Special Elements used in a Command/Expression) and CWE‑89 (Improper Neutralization of Special Elements used in SQL Statements).

The flaw exists in code‑projects Matrimonial System version 1.0. No other versions are currently listed as affected, and the vendor identified is code‑projects, with the product name Matrimonial System. Users running this exact version are directly exposed to the risk.

The CVSS score of 5.3 indicates moderate severity, while EPSS data is not available, suggesting uncertainty about current exploitation prevalence. The flaw is publicly disclosed and can be carried out remotely by sending a crafted request to the create_profile endpoint. It is not listed in CISA’s KEV catalog, but the existence of a public exploit means it poses a tangible threat to any system that has not mitigated the injection.