Description
A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-08-09
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An SQL injection flaw exists in the /admin/AdminLogin.php script of code‑projects Task Management System 1.0. By manipulating the email or password parameters, an attacker can inject arbitrary SQL that is executed against the database. This flaw is a CWE‑74 combined with CWE‑89 and could expose, modify, or delete data in the system’s database, compromising confidentiality, integrity, and availability.

Affected Systems

The vulnerable product is code‑projects Task Management System version 1.0, specifically the AdminLogin.php file. No alternative versions are listed. The product is hosted on code‑projects.org and its source is available on GitHub under the user littleRain1355.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity, and the EPSS score is not available, so the likelihood of exploitation is uncertain. The flaw is not listed in the CISA KEV catalog. Attackers can perform the injection remotely via crafted HTTP requests to the admin login endpoint, and an exploit has already been published, suggesting active use.

Generated by OpenCVE AI on August 9, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the application to a patched version that addresses the SQL injection in AdminLogin.php
  • Modify the login handler to use prepared statements or properly escape the email and password inputs to prevent SQL injection
  • Ensure administrative access is limited, use HTTPS, and monitor login attempts for suspicious activity

Generated by OpenCVE AI on August 9, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 09 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Title code-projects Task Management System AdminLogin.php sql injection
First Time appeared Code-projects
Code-projects task Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:task_management_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects task Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Task Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-09T07:45:08.509Z

Reserved: 2026-08-08T13:32:17.786Z

Link: CVE-2026-19343

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-09T09:30:12Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')