The vulnerability is a classic SQL injection flaw in the Web application's modal_view.php script. An attacker can supply crafted input that is not properly sanitized and that is executed by the underlying database, potentially disclosing sensitive student and alumni records or modifying stored data. The weakness matches the Common Weakness Enumeration identifier CWE-89.

The affected software is Carmelo's Simple Student Alumni System, version 1.0, as deployed from the source at the referenced GitHub repository. No other vendors or product versions are listed as impacted.

The CVSS base score of 9.8 indicates a high severity level, but the EPSS score of less than 1 percent suggests that real‑world exploitation events are currently rare. Because the flaw is exposed to remote users through the web interface, the attack vector is public, and no authentication or elevated privileges are required to trigger the exploit. The system is not listed in the CISA KEV catalog, meaning no publicly known exploits are catalogued yet. Nonetheless the high severity warrants early attention and mitigation.