A flaw in the dodelete.php script of the Events‑Management‑System allows an attacker to manipulate the value of the ID parameter, resulting in an SQL injection that can be executed remotely. The injected payload may enable the execution of arbitrary SQL statements, thereby potentially exposing sensitive data, modifying records, or affecting the integrity of the database. The vulnerability is reported as publicly exploitable, indicating that malicious actors can already deploy attacks using existing code.

The issue affects the satya‑vinay Events‑Management‑System, with the vulnerability present in all versions up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. As the project uses a rolling‑release model, specific release versions are not enumerated, so any deployment of the system before the patch is vulnerable.

The CVSS base score is 6.9, which falls into the moderate severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, yet the existence of a publicly available exploit and the remote nature of the attack vector suggests a realistic risk of exploitation. The attack requires only the ability to supply a crafted ID value to the registration‑delete handler, making it relatively easy for remote attackers to launch the injection.