A vulnerability has been identified in itsourcecode University Management System version 1.0, specifically in the add_result.php handler. An attacker can tamper with the subject parameter to insert malicious SQL, allowing untrusted input to be executed directly against the database. This flaw qualifies as an SQL injection vulnerability, listed under CWE‑74 and CWE‑89. The injection can be performed remotely because the vulnerable page is exposed to external traffic; attackers may read, modify, or delete data through crafted requests.

The affected product is itsourcecode University Management System version 1.0. No other vendors or versions are listed as impacted. The vulnerability resides in the add_result.php component of that system.

The CVSS v3.1 score of 6.9 indicates a medium severity risk. The EPSS score is less than 1%, reflecting a low probability that this flaw is currently being exploited in the wild. It is not yet cataloged in CISA’s KEV list. Because the flaw can be triggered via a remote HTTP request, the attacker only needs network connectivity to the vulnerable service and does not require elevated privileges on the host. Publicly available exploit code was observed, which could expedite attacks if the target is not patched.