A flaw in the login.php file of code‑projects Content Management System version 1.0 allows an attacker to manipulate the user_name parameter, which is incorporated into a SQL query without proper sanitization or parameterization, leading to arbitrary SQL code execution. This could permit the attacker to read, modify, or delete data stored in the CMS database. The description states that the attack can be executed remotely and public exploit code is available. Based on the description, it is inferred that the injection could provide control over the database, potentially leaking sensitive information or altering data, although the exact capabilities depend on the database state and permissions.

This flaw affects installations of code‑projects Content Management System version 1.0. The CNA delineates affected products as code‑projects:Content Management System. No further sub‑versions are specified; thus any instance of this baseline release that has not received a patch remains vulnerable.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the precise probability of exploitation is unknown. The CVE notes that the exploit has been released to the public, signifying that the vulnerability is already in the wild. The vulnerability is not listed in the CISA KEV catalog. The remote nature of the attack vector means any machine that can reach the login endpoint over the network is potentially exposed. An attacker does not need authentication to launch the injection.