The vulnerability lies in the login.php file where the authentication query is built by directly concatenating the email and password parameters into a SQL string. This lack of escaping or parameterization allows an attacker to inject SQL statements such as "' OR 1=1 LIMIT 1--" to bypass authentication, thereby gaining unauthorized system access. No additional impact such as data deletion is described in the updated information, and the attack primarily compromises confidentiality and integrity by allowing unauthenticated access.

The affected application is "Harsh21Patel Inventory-Management-System-PHP". No specific version information is available, so all releases that contain the vulnerable login.php code should be considered at risk.

With a CVSS score of 9.8, the vulnerability is critically severe. The EPSS score is 0.00342, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the absence of any authentication checks on the exposed login endpoint means an unauthenticated attacker can reach and exploit this endpoint over the network using standard HTTP requests.