This vulnerability involves an SQL injection in the delete_photos.php file of code-projects Social Networking Site 1.0. Specifically, the ID parameter can be manipulated remotely to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vulnerability was published on 2026-03-27, with public exploit code released, but no vendor patch or fix details have been provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium with limited confidentiality, integrity, and availability effects. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or parameterized queries on the ID parameter in delete_photos.php to mitigate SQL injection risks. Monitor vendor channels for updates or patches addressing this vulnerability.