A flaw in the head.php file of code-projects Online Examination allows usernames and passwords submitted by users to be concatenated directly into a SQL statement. This results in a classic SQL injection condition, identified as CWE‑74 and CWE‑89. The vulnerability can be triggered by sending specially crafted values for the uname and password parameters and can lead to unauthorized reading or modification of the database, potentially compromising the confidentiality and integrity of the application.

The affected product is code‑projects Online Examination version 1.0. No vendor‑provided patch or release that addresses the injection is listed in the supplied data. Administrators should consult the project maintainers or the upstream repository for any update that resolves the issue.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1 % suggests a low but non‑zero probability of real‑world exploitation. The issue is not in the CISA KEV catalog. The description states that an attacker can launch the attack remotely via standard HTTP requests that include the uname and password parameters; however, it does not specify whether authentication is required, so it is unclear if the vulnerability is limited to authenticated users or can be abused by unauthenticated actors.