The code-projects Inventory Management System version 1.0 contains a SQL injection vulnerability in the Login component. An attacker can manipulate the Username parameter to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, and no privileges required. No official patch or remediation guidance has been published yet.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database via the Login component's Username parameter. This could lead to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk. However, the impact is rated medium, indicating some limitations or mitigations may exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider implementing input validation or web application firewall rules to detect and block SQL injection attempts targeting the Username parameter in the Login component.