This vulnerability affects code-projects Lost and Found Thing Management 1.0, specifically in the /catageory.php file. By manipulating the 'cat' parameter, an attacker can perform SQL injection, potentially allowing unauthorized database queries. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited details on the extent of database control and no known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the 'cat' parameter in /catageory.php.