This vulnerability involves SQL injection in the confirm_logged_in function of /studentdel.php within the yashpokharna2555 StudentManagementSystem. Manipulation of the ID parameter allows an attacker to inject SQL queries remotely without authentication or user interaction. The product's rolling release nature means no fixed version or patch details are available. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not yet issued a fix or official remediation guidance.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. Since the vulnerability can be exploited remotely without privileges or user interaction, it poses a significant risk to the confidentiality and integrity of the system's data. However, the CVSS vector indicates low to limited impact on availability and scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or web application firewalls to block malicious SQL injection attempts until an official patch is available.