The vulnerability CVE-2026-19919 in code-projects Online Shopping System 1.0 allows remote attackers to perform SQL injection via the email parameter in the /login.php Login component. This flaw arises from improper input validation or sanitization of the email argument, enabling injection of malicious SQL commands. The CVSS 3.1 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and low to limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no vendor patch or remediation has been disclosed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the email parameter in /login.php. Avoid exposing the vulnerable endpoint unnecessarily.