This vulnerability in yashpokharna2555 StudentManagementSystem (commit cb2f558ddf8d19396de0f92abf2d224d46a0a203) involves SQL injection via the confirm_logged_in function in student_trans.php. Attackers can manipulate the FIRST_NAME, Last_Name, or EMAIL parameters to inject SQL code remotely. The issue was reported early but the vendor has not responded or provided a fix. The product's rolling release model means versioning details for affected or patched releases are unavailable. The CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to medium impact on confidentiality, integrity, and availability.

Successful exploitation can allow an attacker to execute arbitrary SQL commands remotely by manipulating input parameters, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. No known active exploits have been reported.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no patch links exist, users should monitor the vendor's project for updates. Until a fix is released, consider implementing input validation or web application firewall rules to detect and block suspicious SQL injection attempts targeting the affected parameters.