The Smart Parking System 1.0 application contains an input validation flaw in the /parkings/parkings.php script that allows attackers to manipulate the street, city, and status parameters. This manipulation leads to an SQL injection vulnerability, enabling a remote attacker to execute arbitrary SQL statements against the database. If exploited, the attacker could read, modify, or delete data, compromising the confidentiality, integrity, and availability of the system. The weakness is characterized by CWE-74 and CWE-89.

The vulnerability affects the code-projects Smart Parking System version 1.0. Only the /parkings/parkings.php endpoint is documented as vulnerable, and no other versions or product variants are listed in the CNA data.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation campaigns. Based on the description, it is inferred that authentication may not be required to reach the vulnerable endpoint, but the attack can be executed remotely once the endpoint is reachable.