Description
A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
Published: 2026-08-15
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection vulnerability exists in the /login.php file of the code‑projects Online Shopping System 1.0. The unvalidated email argument allows a malicious user to inject arbitrary SQL via the Login component. The flaw is a CWE‑74 and CWE‑89 weakness that could enable an attacker to read, modify, or delete data in the underlying database, potentially leading to compromise of customer information or disruption of service.

Affected Systems

The affected product is code‑projects Online Shopping System version 1.0. Attackers can target the login endpoint directly from the internet and exploit the injection flaw in the email parameter.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity. Exploitation is possible remotely and a proof‑of‑concept has been made public, yet the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the presence of a public exploit and the remote attack vector elevate the risk, warranting prompt attention.

Generated by OpenCVE AI on August 16, 2026 at 00:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑issued patch or upgrade to a version where the login.php input is processed with prepared statements.
  • If a patch is not available, modify the application to perform strict input validation on the email field and use parameterized queries to eliminate injection.
  • Restrict access to the /login.php endpoint to trusted hosts or enforce TLS to reduce exposure.

Generated by OpenCVE AI on August 16, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
Title code-projects Online Shopping System Login login.php sql injection
First Time appeared Code-projects
Code-projects online Shopping System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Shopping System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Shopping System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-15T23:30:10.514Z

Reserved: 2026-08-15T05:21:42.145Z

Link: CVE-2026-19919

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T00:16:50.360

Modified: 2026-08-16T00:16:50.360

Link: CVE-2026-19919

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T00:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')