The vulnerability CVE-2026-19343 affects code-projects Task Management System version 1.0. It is caused by improper sanitization of input parameters (email and password) in the /admin/AdminLogin.php file, allowing an attacker to perform SQL injection remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Exploit code has been published, but no known active exploitation in the wild is reported. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the email or password parameters, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the affected parameters, restrict access to the /admin/AdminLogin.php endpoint, and monitor for suspicious activity targeting this vulnerability.