The vulnerability is a classic SQL injection discovered in the "/admin/accepted-appointment.php" script of PHPGurukul Beauty Parlour Management System. A malicious user can manipulate the "delid" argument in a request to inject arbitrary SQL commands into the backend query. This flaw permits the attacker to read, modify, or delete database records, potentially exposing customer information or allowing the creation of privileged accounts. The description notes that the attack may be launched remotely and that a public exploit is available, indicating that any user with web access to the affected endpoint could exploit the flaw without additional collateral damage.

The affected product is PHPGurukul Beauty Parlour Management System, version 1.1. No other versions or additional vendors are listed, so remediation efforts should focus on this specific build.

The CVSS score of 6.9 reflects a moderate severity that includes potential impact on confidentiality and integrity. The EPSS score of less than 1% suggests that, at present, exploitation is unlikely to be widespread, but the public availability of an exploit means the vulnerability should not be ignored. Because the flaw is exploitable remotely via a web request, attackers with network access to the application can attempt exploitation with minimal effort. The system is not listed in the CISA KEV catalog, which does not indicate current high-profile exploitation, but the presence of a known vulnerability remains a significant concern for administrators.