An SQL injection vulnerability exists in anirbandutta9 College-Notes-Gallery in the login.php file, where manipulation of the user or pass parameters can lead to SQL injection attacks. This vulnerability is remotely exploitable without authentication or user interaction. The product's rolling release model means affected versions are not specifically enumerated. The vendor did not provide a response or patch information. Public exploit details have been disclosed, but no known active exploitation in the wild is reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, the CVSS vector indicates low to low integrity and availability impact, and no confirmed active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are provided, users should monitor for official updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting login.php parameters.