The StudentManagementSystem application contains a SQL injection flaw in the studentdel.php confirm_logged_in function. By manipulating the ID argument, an attacker can inject arbitrary SQL statements. The vulnerability allows remote exploitation because the affected endpoint is reachable over the network. Injected payloads could enable the adversary to read, modify, or delete student records, compromising confidentiality, integrity, and availability of the database.

The vulnerability applies to the StudentManagementSystem project hosted by yashpokharna2555. No specific release tags are listed because the project follows a rolling release model, so any deployment built from the source that has not applied the fix is affected.

The CVSS score of 6.9 indicates a high severity threat. The EPSS score is not available, but the exploit has been published and the product is immune to patching via versioning due to continuous delivery. Because the flaw is accessible remotely and the code paths are unprotected, the likelihood of exploitation is significant, especially if the application is exposed to the internet. The vulnerability is not recorded in the CISA KEV catalog, but it remains a known public issue.