The vulnerability is a classic SQL injection found in the admin view employee page of the source code. It allows an attacker to inject arbitrary SQL statements through the request parameters handled by the page.

The flaw exists solely in SourceCodester Online Employees Work From Home Attendance System version 1.0. No additional vendor or version details are available from the CVE entry.

The CVSS score of 2.7 marks this as a low‑severity issue, the EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires access to the /wfh_attendance/admin/view_employee.php endpoint, suggesting that administrative credentials or unauthenticated access to the admin area would be prerequisites for exploitation. No public exploit code has been reported at this time, but the potential for unauthorized data manipulation warrants remediation.