This vulnerability affects code-projects Easy Blog Site 1.0 in the login.php file. An attacker can manipulate the username or password input parameters to perform SQL injection attacks remotely without any privileges or user interaction. The vulnerability is confirmed and publicly disclosed, but no official patch or remediation guidance is currently available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database via the login.php parameters, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score, reflecting limited but significant risk to data confidentiality and integrity. There are no reported active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce SQL injection risk. Monitor vendor channels for updates and apply patches promptly once available.