The assignInstructorSubjects.php script in the Online Student Enrollment System v1.0 contains a SQL injection flaw. The 'subjcode' parameter is inserted directly into an SQL query without sanitization, giving an attacker the ability to inject arbitrary SQL statements. This weakness can lead to unauthorized reading, modification, or deletion of enrollment data, exposing sensitive student records and potentially compromising the integrity and confidentiality of the database.

The vulnerability affects the Online Student Enrollment System, version 1.0, as identified by the CPE string. No vendor was specified; the product appears to be a lightweight open‑source application. Because the affected file is part of the web application, the flaw resides in a publicly exposed endpoint.

The CVSS score of 9.8 indicates a critical impact, while the EPSS score of less than 1% suggests the risk of current exploitation is low. The system is not listed in CISA's KEV catalog, implying no widespread attacks have been reported yet. The attack vector is likely remote via HTTP requests to assignInstructorSubjects.php, but this is inferred from the description; no authentication requirement was explicitly stated.