A flaw exists in the login.php file of the Cyber-III Student-Management-System where the Password parameter is handled insecurely. This allows attackers to inject arbitrary SQL through the Password field, enabling read or write operations on the underlying database. The vulnerability is exploitable remotely and has already been disclosed publicly, making it a practical threat for unauthorized data exposure or manipulation.

The affected product is the Cyber-III Student-Management-System. Specific version details are not disclosed beyond a commit hash, and the project follows rolling releases, so users cannot pinpoint exact revisions. Any installation using the vulnerable commit range is at risk, regardless of the deployment date.

The CVSS score of 6.9 indicates a medium severity level. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based, requiring remote access to the login endpoint, and the exploit can be executed by anyone with network visibility to the application. Given that the vendor has not yet released a patch, the risk persists until mitigations are applied.