The vulnerability resides in the admin_login.php component of the student_management_system and allows a remote attacker to manipulate the a_usr and a_pwd parameters to inject arbitrary SQL. By exploiting this flaw an attacker can read, modify, or delete database records, potentially exposing sensitive information and enabling further credential compromise. The flaw is publicly known and a release of an exploit is available, underscoring its practicality.

All builds of the student_management_system developed by imvks786 that contain the code before the commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46 are affected. The project uses a rolling release approach, so any release prior to this commit remains vulnerable and no patched version is listed in the information provided.

The CVSS score of 6.9 indicates moderate severity, and while the EPSS score is not available the existence of public exploits indicates a real risk. The vulnerability is not in the CISA KEV catalogue, yet it can be exploited remotely without prior authentication, making the attack vector straightforward and increasing the urgency of remediation.