A vulnerability has been found in code-projects Task Management System In PHP 1.0. (CVE-2026-86180)

This vulnerability affects an unknown functionality within the /index.php file of the login component in code-projects Task Management System In PHP 1.0. Manipulating the 'email' argument leads to SQL injection, enabling an attacker to execute arbitrary SQL commands remotely. The vulnerability is identified as CWE-74 and has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Public exploit disclosure exists, but no confirmed exploitation in the wild is noted. No vendor advisory or patch information is provided.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection via the 'email' parameter, potentially leading to unauthorized data access, data modification, or denial of service. The impact affects confidentiality, integrity, and availability at a low level according to the CVSS vector. The presence of public exploit code increases the risk of exploitation, although no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation and parameterized queries on the 'email' parameter in the login component to mitigate SQL injection risks. Monitor for updates from the vendor or trusted security sources.