The code-projects Task Management System 1.0 contains a SQL injection vulnerability in the Operation::select_with_multiple_condition function of the /index.php file's Login Form component. This vulnerability allows remote attackers to manipulate the email parameter to perform SQL injection attacks. The vulnerability is publicly known and exploitable remotely without authentication. The CVSS 4.0 score is 6.9, reflecting medium severity with network attack vector and low complexity. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. However, no confirmed active exploitation in the wild has been reported. The impact is rated medium severity based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable component or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the email parameter.