The vulnerability resides in the cat parameter of the /catageory.php file in code‑projects Lost and Found Thing Management 1.0. By manipulating this argument an attacker can inject SQL code which is then executed against the application's database. This flaw falls under CWE‑74 and CWE‑89 and allows the attacker to read, modify, or delete data stored in the database, thereby compromising confidentiality and integrity.

Only the code‑projects Lost and Found Thing Management 1.0 application is listed as affected. No other vendors, versions or sub‑components are mentioned in the available CNA data.

The CVSS base score of 6.9 indicates moderate severity. No EPSS data or KEV listing is available. The vulnerability can be exploited remotely through the /catageory.php endpoint, and public exploit code has been shared, so the risk remains significant for internet‑exposed deployments.