This vulnerability involves an SQL injection in the Lost and Found Thing Management 1.0 product by code-projects. Specifically, the issue is in the /addcat.php file where the 'cata' parameter is not properly sanitized, allowing an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor, and the exploit code is publicly available.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection attacks via the 'cata' parameter in /addcat.php. This could lead to unauthorized access or modification of the database, potentially compromising data confidentiality and integrity. The impact is rated medium based on the CVSS score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or filtering on the 'cata' parameter to mitigate injection risks. Monitoring for unusual database queries or access patterns may help detect exploitation attempts.