A flaw in the admin login feature of itsourcecode Event Management System 1.0 allows an attacker to manipulate the Username field to inject arbitrary SQL. This vulnerability is a classic SQL injection that can be triggered remotely via the /admin/ajax.php endpoint. If successfully exploited, an attacker could read, modify, or delete database data, compromising sensitive event details and potentially exposing user credentials.

The affected product is itsourcecode Event Management System version 1.0, released by itsourcecode. No other versions have been documented as vulnerable. All installations running that specific version are at risk until the flaw is addressed.

The CVSS score of 6.9 places this flaw in the medium range, while an EPSS of less than 1 % suggests a low current likelihood of widespread exploitation. Nevertheless, because the attack can be performed over the internet and public proof‑of‑concept code exists, the potential impact remains significant. The vulnerability is not listed in the CISA KEV catalog, indicating that no large‑scale incidents have been reported yet, but the availability of exploits warrants timely mitigation.