A SQL injection vulnerability in the Downtime component of the School Management System allows unauthenticated attackers to execute arbitrary SQL commands via the medium parameter at admininsert.php. The vulnerability has a CVSS score of 9.8. The issue affects versions up to and including 24.04.3, 23.10.13, 23.04.19, and 22.10.23. The vulnerability allows an attacker to access sensitive information from the database.