The vulnerability resides in the manage_register.php page of itsourcecode Event Management System 1.0. By manipulating the ID argument supplied to the script, an attacker can inject arbitrary SQL statements into the backend database. This flaw allows unauthenticated users to read, modify, or delete data stored in the system, leading to potential data breach and loss of integrity for events, registrations, and user information. The issue is a classic SQL injection type flaw (CWE‑74, CWE‑89) that can be exploited remotely without special privileges.

Affected products are the itsourcecode Event Management System version 1.0. The vulnerability is tied to the file /admin/manage_register.php and specifically impacts the handling of the ID parameter in that application.

The severity score of 6.9 (medium) coupled with a very low EPSS likelihood (<1%) indicates that while the flaw is serious enough to allow data compromise, it is not a high-probability target for automated exploitation. The flaw can be reached remotely over the internet and, once exploited, permits arbitrary SQL execution. The system is not currently listed in the CISA KEV catalog, meaning no confirmed public exploits are reported, but the disclosure is available, so defenders should not assume there is no threat.