A SQL injection flaw exists in the scheduleSubList.php component of the Online Student Enrollment System. The subject code parameter is inserted into an SQL statement without validation, allowing an attacker to craft malicious input that can execute arbitrary SQL commands. This could expose or alter sensitive student records, leading to confidentiality and integrity violations.

The vulnerability affects the Online Student Enrollment System version 1.0, as identified by its CPE entry. No additional vendor or product context is available.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests the exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via a web client that can supply the subjcode parameter to the exposed PHP endpoint. Successful exploitation would likely require the ability to send crafted HTTP requests to the application, either by unauthenticated or authenticated users depending on access controls, which are not specified in the description.