CVE-2026-19919 is a SQL injection vulnerability in code-projects Online Shopping System 1.0 affecting the /login.php login component. The vulnerability results from improper sanitization or validation of the 'email' argument, enabling remote attackers to inject malicious SQL commands. This can lead to unauthorized data access or modification. The vulnerability has been publicly disclosed with exploit code available, but no confirmed active exploitation has been reported. No official patch or fix has been provided as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the email parameter in the login functionality. This may lead to unauthorized disclosure, modification, or deletion of data, impacting confidentiality, integrity, and availability of the system. The CVSS 3.1 base score of 7.3 reflects a moderate level of risk with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and parameterized queries on the email parameter in the login component to mitigate SQL injection risks.