An injection flaw exists in the User parameter of the /web/admin/login.php script of code‑projects Simple Content Management System 1.0. By manipulating that argument, an attacker can inject arbitrary SQL code, allowing unauthorized read or write access to the underlying database. The vulnerability can lead to data theft, modification, or deletion, and if an attacker gains sufficient privileges, it may provide a foothold to further compromise the system.

The vulnerability affects the code‑projects Simple Content Management System version 1.0. No other versions or related products are listed as impacted.

The CVSS score of 6.9 indicates moderate severity, and the exploit can be launched remotely. Publicly available exploit code has been reported, implying that attackers could freely target systems with this flaw. Although the EPSS score is not available and the issue is not listed in KEV, the combination of a remote attack surface and publicly disclosed exploitation code raises the risk of real-world impact for unpatched installations.