This vulnerability involves an SQL injection flaw in the yashpokharna2555 StudentManagementSystem at the /success.php file, where manipulation of the User parameter can lead to injection attacks. The vulnerability is remotely exploitable without authentication or user interaction. The product's rolling release approach means no fixed version numbers are available, and no official remediation or patch has been published. Public exploit code exists, increasing the risk of exploitation. The vendor has not yet addressed the issue.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score of 6.9 (medium severity) reflects the network attack vector, low complexity, no privileges or user interaction required, and limited scope and impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitoring for unusual database activity and restricting access to the affected endpoint may reduce risk until an official fix is available.