This vulnerability in code-projects Employee Management System 1.0 allows remote attackers to exploit an SQL injection flaw via the 'pwd' parameter in the /370project/process/eprocess.php file. The weakness enables unauthorized manipulation of SQL queries, potentially leading to data exposure or modification. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been documented yet.

Successful exploitation can allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries to mitigate SQL injection risks in the affected component. Monitor vendor channels for updates and apply patches promptly once released.