SQL injection is present in the Simple Student Alumni System v1.0, specifically through the teacherID parameter of the /TracerStudy/recordteacher_view.php endpoint. The flaw allows an attacker to inject arbitrary SQL statements, which can lead to viewing, updating, or deleting data stored in the underlying database. This threatens the confidentiality and integrity of student and alumni records.

The affected product is the Simple Student Alumni System, version 1.0. No specific vendors are listed in the CNA data; the vulnerability is tied to this single software release.

The CVSS score of 4.9 places this issue in the moderate range, yet the EPSS score of less than 1 percent indicates that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is inferred to be remote via the web interface, as it is triggered by supplying a crafted teacherID value in an HTTP request.