A SQL injection flaw exists in the doedit.php component of the Events-Management-System, triggered by unsanitized user inputs such as id, name, title, year, gender, fromdate, todate, and people. The vulnerability allows an attacker to inject arbitrary SQL through the mysqli_query function, which can result in unauthorized data reads, writes, and potentially deletion. This weakness is identified as CWE-74 and CWE-89 and is capable of remote exploitation, enabling attackers to manipulate or exfiltrate database contents without prior authentication.

The flaw affects the open-source Events-Management-System built by satya-vinay. Endpoints up to the commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a are vulnerable. The project follows a rolling release strategy with no explicit version numbers for fixed releases, so users should check the repository for updates after the discovery.

The CVSS score is 6.9, indicating a medium to high severity. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, but the public disclosure and ability to achieve remote exploitation raise the practical risk. As the flaw is exploitable remotely, an attacker can leverage it from any network accessible to the web application, provided the database is reachable.