CVE-2026-86181: Cross Site Scripting in code-projects Task Management System

This vulnerability in code-projects Task Management System 1.0 involves improper sanitization of the lname argument in the /user/UpdateUserProfile.php file within the User Profile Update component. An attacker can remotely exploit this flaw to perform cross-site scripting (CWE-79), potentially injecting malicious scripts. The CVSS 3.1 score is 3.5 (low), indicating limited impact primarily on integrity with no confidentiality or availability impact. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No patch or official remediation guidance is provided in the available data.

The vulnerability allows an attacker with at least low privileges (PR:L) and user interaction (UI:R) to inject malicious scripts via the lname parameter, potentially affecting the integrity of user interactions or data. There is no impact on confidentiality or availability. The attack can be launched remotely over the network. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or sanitization controls on the lname parameter to mitigate XSS risks. Monitor official vendor channels for updates.