This vulnerability exists in the login_check.php file of the raisulislamg4 student_management_system_by_php project, where improper handling of the Username parameter leads to SQL injection. An attacker can remotely exploit this flaw without authentication or user interaction. The project has been informed but has not issued a fix or response. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector and no privileges required.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider applying manual mitigations such as input validation and parameterized queries in the login_check.php file if possible. Monitoring for updates from the vendor is recommended.