The vulnerability exists in the code-projects Task Management System 1.0, specifically in the Operation::select_with_multiple_condition function of the /index.php file related to the Login Form component. Manipulating the email parameter leads to SQL injection, enabling an attacker to execute unauthorized SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but no vendor-provided fix or mitigation guidance is currently documented.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the email parameter. This may lead to unauthorized data access or modification. However, the impact is rated medium, reflecting limited scope or complexity of exploitation and the absence of confirmed active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected component or applying web application firewall rules to detect and block SQL injection attempts targeting the email parameter.