This vulnerability affects code-projects Inventory Management System version 1.0. It allows an unauthenticated remote attacker to perform SQL injection by manipulating the Username parameter in the Login component. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability could allow an attacker to execute unauthorized SQL commands against the backend database. No official fix or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The attack can be performed remotely without authentication, increasing the risk. However, the impact is rated medium due to limited details on the extent of data exposure or system compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is documented, users should monitor for vendor updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Username parameter in the Login component.