A SQL injection flaw in the username parameter of login.php allows an attacker to inject arbitrary SQL commands into the authentication query. This enables the attacker to read, modify, or delete database records, potentially gaining unauthorized access to sensitive user data and escalating privileges if the database user has elevated rights.

The vulnerability exists in the PHP-MYSQL-User-Login-System version 1.0, a publicly available web application with no listed vendor. The affected component is the login.php script that processes user credentials.

With a CVSS score of 9.8 the flaw is critical, while the EPSS score of less than 1% suggests current exploitation activity is low but still possible. The system is not listed in CISA's KEV catalog. The likely attack vector is a web request directed at the login endpoint; an attacker submits a crafted username payload to manipulate the SQL query. If the vulnerability is exploited, the attacker can exfiltrate data or compromise the entire database.