CVE-2026-19345
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A missing authorization vulnerability exists in code-projects Task Management System 1.0 in /user/UpdateTaskStatus.php. Manipulating task_id/val arguments leads to missing authorization. The attack can be launched remotely. The exploit is public.
Risk Assessment
An attacker can change task statuses without proper permissions, potentially leading to data integrity issues in the system.
Recommendation
Apply patches or update the system. Implement proper access control mechanisms.
Other vulnerabilities in code-projects Task Management System
See all- CVE-2026-19344High
A SQL injection vulnerability exists in code-projects Task Management System 1.0 in /user/comment_count_user.php. Manipulating the task_id argument allows remote SQL queries. The exploit is public.
- CVE-2026-19343High
A SQL injection vulnerability exists in code-projects Task Management System 1.0 in /admin/AdminLogin.php. Manipulating email/password arguments allows remote SQL queries. The exploit is public.
- CVE-2026-19342High
A vulnerability in code-projects Task Management System 1.0 in the Login component of /index.php allows improper authentication via manipulation of the Password argument. The attack can be performed remotely. The exploit is public.
Original NVD description (English source)
A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS