A SQL injection flaw was discovered in the login.php script of the College-Notes-Gallery application. The flaw arises when user credentials are concatenated directly into an SQL query, allowing an attacker to inject arbitrary SQL statements. This can result in unauthorized read or write access to the backend database, potentially exposing sensitive user data or compromising the integrity of stored information. The underlying weakness aligns with CWE-89 (SQL Injection) and CWE-74 (Malformed Injection).

The vulnerability affects all releases of anirbandutta9’s College-Notes-Gallery up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6. The application follows a rolling‑release model, so specific patch versions are not publicly enumerated. Administrators should assume that the current deployed instance is vulnerable unless a newer commit featuring a fix is deployed.

The CVSS score of 6.9 indicates a high‑severity vulnerability. EPSS information is currently unavailable, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so the likelihood of an immediately successful exploitation remains uncertain. The flaw can be triggered by any remote party that can query the public login page, and the exploit has already been made publicly available. In the absence of a vendor response, the risk of exploitation remains significant, especially for publicly exposed installations.