A flaw exists in the News Portal Project 1.0 code under /newsportal/admin/edit-category.php, where a Category argument can be manipulated to inject arbitrary SQL statements. The vulnerability is based on improper handling of user input (CWE-74) and the classic SQL Injection weakness (CWE-89). If exploited, an attacker can read, modify, or delete database records. The impact threatens data confidentiality, integrity, and could lead to full compromise of the application.

The affected product is itsourcecode News Portal Project 1.0, the only version mentioned in the advisory. No other releases or vendor versions are listed. Administrators managing this specific build are exposed to the risk.

The CVSS score of 6.9 indicates a moderate-assessable severity, while the EPSS score of less than 1% suggests a low exploitation probability in the current moment. The vulnerability is not part of the CISA KEV catalog, but public exploit code has been released and can be performed remotely via an HTTP request to edit-category.php. Attackers would need network access to the admin interface and can leverage the unsanitized Category parameter to inject SQL.