CVE-2026-86180
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A SQL injection vulnerability was found in code-projects Task Management System In PHP 1.0 in the file /index.php of the Login component. Manipulating the email argument leads to SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could gain unauthorized access to the system or data, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the system or apply patches, and use parameterized queries.
Related vulnerabilities
- CVE-2026-90888Critical
The LeadSnap WordPress plugin in versions up to 1.25 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39738Critical
The FunnelKit Automations WordPress plugin in versions up to 3.8.6.1 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39732Critical
The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.
- CVE-2026-119526Critical
The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.
- CVE-2026-116852Critical
The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.
- CVE-2026-116386Critical
The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.
- CVE-2026-118697Critical
In JetBrains Toolbox App before 3.9.1 and 3.8.2, and IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates. This may allow an attacker to impersonate a trusted component.
- CVE-2026-61826Critical
Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, allowing anonymous callers to perform configuration-mutating operations such as logging out the Plex integration, persisting an attacker-selected API key, binding an attacker-controlled Plex account token, and other `write_config()` operations. Missing OAuth state validation and attacker-controlled server URLs further enable server-side request forgery and credential exposure.
- CVE-2026-112816Critical
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.
- CVE-2026-119706Critical
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability. Attackers can send a base64-encoded crafted pickle in serialized_named_tensors to the /update_weights endpoint, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Original NVD description (English source)
A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS