Description
A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-06
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an SQL injection flaw in the email parameter of the login page (/index.php). By injecting SQL code, an attacker can manipulate database queries, potentially exfiltrating sensitive information or altering data. The flaw is exploitable remotely without authentication.

Affected Systems

The affected product is code‑projects Task Management System In PHP, version 1.0. The vulnerability impacts the login functionality exposed by index.php. No other versions or additional components are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw via a web request from any remote host. Given the lack of authentication requirement, the risk of exploitation is relatively high for environments where the system is publicly reachable.

Generated by OpenCVE AI on September 6, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch or upgrade to the latest release of Task Management System In PHP that resolves the SQL injection flaw.
  • If no patch is available, modify index.php to use prepared statements or properly escape the email parameter to prevent injection.
  • Restrict access to the login endpoint to authenticated users only and implement web application firewall rules that detect and block obvious SQL injection payloads.

Generated by OpenCVE AI on September 6, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Task Management System In PHP Login index.php sql injection
First Time appeared Code-projects
Code-projects task Management System In Php
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:task_management_system_in_php:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects task Management System In Php
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Task Management System In Php
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-06T08:00:10.513Z

Reserved: 2026-09-05T10:46:00.447Z

Link: CVE-2026-86180

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-06T08:16:41.910

Modified: 2026-09-06T08:16:41.910

Link: CVE-2026-86180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T09:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')