The vulnerability lies in an unknown function within the post.php file of the Easy Blog Site 1.0, where manipulating the tags argument allows an attacker to inject arbitrary SQL statements. This flaw can be triggered remotely through the web interface and has been publicly released, meaning an adversary can exploit it without special credentials. The resulting injection could reveal sensitive data, alter or delete database contents, and potentially compromise the integrity and confidentiality of the hosted content.

All installations of the code-projects Easy Blog Site version 1.0 are affected, as the flaw originates in the core post.php script. The vulnerability is not limited to specific configurations and applies to any instance that accepts user‑supplied tags via HTTP requests.

The CVSS score of 5.3 places this at a medium risk level, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified. It is not listed in the CISA KEV catalog. The flaw can be exploited remotely, so a penetration test or web proxy could be used to inject malicious tags into the URL or form data. The absence of a CNA‑issued patch or workaround means users must either update the application or mitigate the issue through code changes.