The Hospital Bed Management System version 1.0 from code-projects contains a SQL injection vulnerability in its Login Form component. An attacker can remotely exploit this by manipulating the Username parameter, potentially allowing unauthorized database queries. The vulnerability is confirmed and publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the Login Form's Username parameter. This may lead to unauthorized data access or modification. However, the impact is rated medium based on the CVSS score and vector, indicating limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to apply input validation and sanitization on the Username parameter to mitigate SQL injection risks. Monitor vendor communications for official fixes.