This vulnerability affects code-projects Employee Management System version 1.0. It involves an SQL injection flaw in the Admin Login Endpoint, specifically in an unknown function of the /process/aprocess.php file. The vulnerability arises from improper handling of the mailuid argument, which can be manipulated to inject SQL commands. The vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no vendor advisories or patches available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other impacts depending on the database privileges. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is available, users should monitor for updates from the vendor. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the mailuid parameter in the /process/aprocess.php endpoint.