This vulnerability allows an attacker to inject arbitrary SQL into the email parameter of the Login Form’s select_with_multiple_condition function at /index.php. The flaw exposes a classic SQL injection path that could let the attacker alter queries and retrieve, modify, or delete data stored in the database. The flaw directly compromises the integrity and confidentiality of the application’s data store, and could provide a foothold for further attacks such as privilege escalation or credential theft.

The issue is present in code-projects Task Management System version 1.0. No other versions are listed as affected. The vulnerability is localized to the login module, but as the login credentials control all user access, the impact spans the entire system for any user that authenticates through this interface.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, but the CVE notes that the exploit is publicly available, suggesting a non‑zero probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Attackers can exploit this remotely by sending crafted requests to the login endpoint from any network that can reach the application.