A vulnerable SQL statement in the admin view page allows malicious input to be injected into database queries. If exploited, an attacker can read sensitive records, alter or delete data, and potentially gain further access to the application. This flaw represents a classic database injection weakness that compromises confidentiality and integrity of the employee attendance data.

The affected product is SourceCodester Online Employees Work From Home Attendance System, version 1.0. No other affected versions are listed.

Specific CVSS, EPSS, or KEV metrics are not provided in the source material. Because SQL injection is a well‑known attack vector that can be performed by inserting special input via the web interface, the risk can be considered moderate to high if the admin interface is reachable. The lack of an official patch or mitigation guidance suggests that immediate action is required to prevent potential exploitation.