CVE-2026-19196 is a SQL injection vulnerability in SourceCodester Photo Share Website 1.0 affecting the login functionality via the 'email' parameter in the /social/ajax.php?action=login endpoint. This flaw allows an unauthenticated remote attacker to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without requiring user interaction. Public exploit code is available, but no confirmed active exploitation has been observed. No patch or official remediation has been provided as of the publication date.

Successful exploitation could allow attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure, modification, or deletion of data. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'email' parameter in the login endpoint. Additionally, review and harden input validation and parameterized query usage in the affected application code.