The Vulnerability occurs in the login component of code‑projects Inventory Management System 1.0. By sending a specially crafted Username argument, an attacker can inject arbitrary SQL statements into the underlying query. This leads to unauthorized data access, database alteration, or deletion, compromising confidentiality, integrity, and availability of the underlying data store.

code-projects Inventory Management System version 1.0, specifically the Login module in unknown function. No other versions are listed, so the attack is limited to this exact release.

The vulnerability has a CVSS score of 6.9, indicating a moderate severity level. The EPSS score is less than 1%, meaning the likelihood of exploitation in the wild is low. It is not listed in the CISA KEV catalog. The exploit is remote, accessible by any networked user with the ability to request the login page, and an active exploit is publicly available.