A vulnerability was identified in the index.py component of code-projects Contact Management System 1.0, where the argument selecteditem[0] is processed without proper sanitization, allowing a SQL injection flaw. The error is capitalized by the absence of input validation, aligning with common injection weaknesses. This flaw can be used by an unauthenticated attacker to execute arbitrary SQL statements against the underlying database, potentially exposing confidential data or modifying records.

The affected product is code-projects Contact Management System, version 1.0.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and there is no publicly disclosed exploitation. The attack vector is remote, as the flaw can be triggered by external requests to the application, with no special privileges required on the server side.