A flaw was discovered in sambitraj's STUDENT-MANAGEMENT-SYSTEM login page where the email input is directly incorporated into a SQL statement. By manipulating the email argument, an attacker can inject arbitrary SQL commands, enabling the disclosure, modification, or deletion of sensitive data. The vulnerability is categorized as CWE-89 (SQL Injection) and is noted as CWE-74, though the primary effect concerns SQL injection.

The affected product is sambitraj's STUDENT-MANAGEMENT-SYSTEM, version 1.0, which is hosted in the public GitHub repository. No other versions are listed as affected, and the vendor has not released a fix as of the last advisory. The issue remains present in the login functionality exposed through the web interface.

The severity of the flaw is reflected in a CVSS score of 6.9, indicating moderate risk. No EPSS score is available, but the advisory notes that an exploit has been publicly released and can be executed remotely via the exposed login page. The vulnerability is not listed in the CISA KEV catalog, yet remote attackers could leverage the flaw without needing local access or privileged credentials. With the absence of an official patch, the threat persists until the underlying code is corrected or mitigated.