CVE-2026-19211 is a SQL injection vulnerability affecting SourceCodester Photo Share Website 1.0. The flaw exists in an unspecified function within the /social/ajax.php?action=signup file, where manipulation of the email parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation. The CVSS 3.1 base score is 7.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. Since exploit code is publicly available, the risk of exploitation is elevated.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying web application firewall rules to detect and block SQL injection attempts targeting the email parameter in the signup action, and restrict database permissions to minimize impact.