An SQL injection vulnerability exists in the addcat.php component of Lost and Found Thing Management version 1.0, triggered by manipulating the cata parameter. This flaw allows an attacker to execute arbitrary SQL statements against the underlying database, potentially leading to data disclosure, alteration, or deletion. The weakness is consistent with CWE-89, reflecting improper handling of user input in database queries.

The affected system is code-projects Sent Lost and Found Thing Management 1.0. Users running this specific version of the web application are susceptible to exploit unless updated or patched.

The vulnerability carries a CVSS score of 6.9, indicating a moderate to high risk level. An attacker can exploit the flaw remotely by sending crafted HTTP requests, and public exploit code has already been released. While EPSS data is not available, the lack of listing in the KEV catalog does not diminish the likelihood or severity of exploitation, especially for deployments still using the unpatched version.