This vulnerability involves an SQL injection in the Login component of SourceCodester/jkev Record Management System 1.0. The issue arises from improper sanitization of the Username parameter in index.php, allowing an attacker to inject malicious SQL queries remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector and no required privileges. No official fix or patch has been published by the vendor as of the vulnerability disclosure date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the impact is rated medium due to limited details on the extent of data exposure or system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL injection. Monitoring for unusual login activity may help detect exploitation attempts.