A single SQL injection flaw exists in the instructorClasses.php script of the Online Student Enrollment System version 1.0. The script directly concatenates the $_GET['classId'] value into a SQL query without validating or sanitizing it, exploiting the weakness identified as CWE-89. An attacker can exploit this to inject arbitrary SQL statements, potentially reading, modifying, or deleting enrollment data and other database contents, thereby compromising confidentiality and integrity.

The vulnerability is present only in the Online Student Enrollment System v1.0 developed by itsourcecode; no other versions or variants are listed as affected. The product name and version are clearly identified in the CPE entry as itsourcecode:online_student_enrollment_system:1.0.

The CVSS baseline score of 9.8 classifies this flaw as critical. The EPSS score is below 1%, indicating that the risk of real-world exploitation is currently low, and the issue is not in the CISA KEV catalog. The likely attack vector is via a crafted HTTP GET request to instructorClasses.php that supplies a malicious classId parameter. Exploitation requires network access to the web application and does not depend on special local privileges.