This vulnerability exists in the Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. It involves SQL injection via the Password parameter in the /login.php component's Parameter Handler. The flaw allows remote attackers to inject SQL commands, potentially compromising the database. The vendor has not yet responded or provided a fix. The rolling release model complicates version tracking for affected or patched releases. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely via the Password parameter, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts. No known active exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded and no patch links exist, users should monitor the vendor's communications for updates. Until a fix is released, consider implementing application-level mitigations such as input validation, parameterized queries, or web application firewalls to reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.