Simple Student Alumni System version 1.0 contains a classic SQL injection flaw in the /TracerStudy/recordstudent_edit.php script. An attacker can supply crafted input that bypasses query logic and manipulates the underlying SQL statements. This enables exploitation of the database, allowing an adversary to read, modify, or delete data, potentially revealing personal information and disrupting system operations.

Only the open‑source "Simple Student Alumni System" developed by the community, version 1.0, is affected. No vendor or patch version information is listed beyond the product name and version.

Based on the description, it is inferred that the attack vector is remote over the web interface, as the vulnerability resides in a publicly accessible PHP script that accepts user input. The flaw results from unsanitized input concatenated directly into SQL statements, creating a classic CWE‑89 vulnerability. The CVSS score of 9.8 indicates high severity, while an EPSS score of less than 1 percent suggests a low current exploitation probability. The vulnerability is not yet recorded in CISA’s KEV catalog, but the lack of a KEV listing does not diminish the risk of unnoticed attacks.