A parameter-based SQL injection exists in the edit-category.php component of Code‑Projects Simple IT Discussion Forum 1.0. By manipulating the cat_id argument, an attacker can inject arbitrary SQL that may read, modify, or delete underlying data. The flaw allows remote exploitation through a web request without needing prior authentication, potentially exposing sensitive information and compromising the integrity of the forum database.

The vulnerability affects the Code‑Projects Simple IT Discussion Forum version 1.0. No other product versions are mentioned in the vulnerability report.

The CVSS score of 6.9 indicates medium severity, and the lack of EPSS data suggests limited publicly known exploitation metrics. The flaw is not listed in the CISA KEV catalog, but the nature of the SQL injection and the remote attack vector mean a successful exploit could lead to data exfiltration or unauthorized database modification. The attack requires web access to the vulnerable page and does not mention authentication bypass, yet the unsanitized parameter makes exploitation straightforward for a determined attacker.