Gate Pass Management System version 2.1 contains a critical SQL injection vulnerability (CVE-2018-25424) that allows unauthenticated attackers to bypass authentication mechanisms. The vulnerability exists in the login-exec.php file where attackers can inject malicious SQL code through login and password parameters via crafted POST requests. This security flaw enables attackers to authenticate without valid credentials and gain unauthorized access to the application. The vulnerability affects the authentication bypass functionality and poses a high security risk to organizations using this system.