Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')