CVE-2026-86181: Cross Site Scripting in code-projects Task Management System

The vulnerability in code-projects Task Management System 1.0 involves improper sanitization of the 'lname' argument in the /user/UpdateUserProfile.php file, leading to cross-site scripting (XSS). This allows an attacker to inject malicious scripts that execute in the context of the victim's browser. The attack vector is network-based, with low complexity and no privileges required, but it requires user interaction. The vulnerability has been publicly disclosed, but no evidence of active exploitation in the wild is reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session. This may lead to session hijacking, defacement, or other malicious actions performed on behalf of the user. However, the impact is limited by the requirement for user interaction and the lack of elevated privileges.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted inputs or links related to the affected application. Implementing input validation and output encoding on the 'lname' parameter can mitigate the risk.