This vulnerability involves SQL injection in the code-projects Feedback System 1.0, specifically in an unknown function of the /admin/checklogin.php file. By manipulating the email parameter, an attacker can inject SQL commands remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed, but no patch or official fix has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the email parameter. This may lead to unauthorized data access or modification depending on the database and application context. However, the impact is rated medium and there is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying application-level mitigations such as input validation and parameterized queries if possible. Monitoring for suspicious activity related to the /admin/checklogin.php endpoint is advisable.