The vulnerability lies in the login.php file where the authentication query is built by directly concatenating the email and password parameters into the SQL string, allowing an attacker to inject SQL statements such as "' OR 1=1 LIMIT 1--" to bypass authentication. The delete.php script runs a DELETE statement with the product_id value taken from the GET parameter without any authentication or validation, enabling an unauthenticated user to delete any product row or perform blind SQL injection with payloads like "0 OR SLEEP(5)". This classic SQL injection flaw (CWE‑89) permits unauthorized authentication and the removal of data, but the provided description does not mention any additional impacts such as data exfiltration or denial of service.

The affected application is "Harsh21Patel Inventory-Management-System-PHP". No specific version information is available, so all releases that contain the vulnerable login.php and delete.php code should be considered at risk.

With a CVSS score of 9.8, the vulnerability is critically severe. No EPSS data is supplied, and the vulnerability is not listed in the CISA KEV catalog, but the absence of any authentication checks on the exposed endpoints means an unauthenticated attacker can reach and exploit these endpoints over the network using standard HTTP requests.