A SQL injection vulnerability (CVE-2026-7131) has been discovered in code-projects Online Lot Reservation System up to version 1.0. The vulnerability affects the /loginuser.php file where manipulation of email/password arguments leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed. The vulnerability allows attackers to potentially access or manipulate the database through the login functionality.