The vulnerability CVE-2026-7229 affects code-projects Coaching Management System 1.0. It is an SQL injection issue located in the POST handler of the /cims/modules/admin/reply.php component, where the complaintreply parameter is improperly sanitized. This allows remote attackers to inject SQL code by manipulating this argument. The vulnerability has been publicly disclosed with an exploit available, but no official fix or patch has been published. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk. However, the impact is rated medium severity based on the CVSS score and vector, reflecting limited privileges and low complexity of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor for vendor updates. As a temporary measure, restricting access to the affected endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the complaintreply parameter may reduce risk.