The vulnerability exists in the /welcome.php file of code‑projects Assessment Management 1.0; an attacker can manipulate the userid parameter to inject arbitrary SQL because it is not validated, leading to a classic SQL injection flaw covered by CWE-74 and CWE-89. The flaw is exploitable remotely and the publicly available exploit enables attackers to execute any SQL statements supported by the database, potentially disclosing or altering sensitive data.

Products affected by this issue include code‑projects Assessment Management version 1.0. No other versions are known to be impacted based on the current CNA data.

The CVSS score of 6.9 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the publicly available exploit and the ability to launch the attack remotely make this flaw a realistic threat. Attackers can craft an HTTP request to /welcome.php, supply a malicious userid value, and feed arbitrary SQL to the backend database, potentially compromising confidentiality, integrity, or availability of the application data.