The code-projects Task Management System version 1.0 contains a SQL injection vulnerability in the /user/comment_count_user.php script. Specifically, the task_id argument is not properly sanitized, enabling remote attackers to inject malicious SQL commands. This vulnerability is identified as CVE-2026-19344 and has a CVSS 3.1 base score of 7.3, indicating a moderate level of risk. Exploit details have been publicly disclosed, but no official patch or fix has been provided by the vendor at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or denial of service. The vulnerability can be exploited remotely without authentication, increasing its risk profile. However, the impact is rated medium due to the scope and complexity indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the task_id parameter. Additionally, review and sanitize all user inputs in the affected script to mitigate exploitation risk.