The vulnerability arises from unsanitized handling of login input in the inventory‑management‑system 1.0.0, allowing a malicious user to inject arbitrary SQL through the username or password fields. The flaw can be triggered remotely by sending crafted requests to the index.php login component, potentially enabling execution of arbitrary SQL queries against the underlying database. This is an injection flaw categorized as CWE‑74 and CWE‑89.

The vulnerability affects the rabindralamsal inventory‑management‑system version 1.0.0, specifically the Login component in the index.php file.

The CVSS score of 6.9 indicates moderate risk; the exploit is publicly available and can be executed remotely via the login interface. Attackers need the ability to send HTTP requests to the application. The potential impact includes the execution of arbitrary SQL commands against the database, which could lead to unauthorized data exposure or modification. EPSS data is not available and the issue is not listed in CISA KEV.