Is there a public PoC exploit available for CVE-2026-19342?

Yes, a public proof-of-concept exploit is available for CVE-2026-19342. Prioritise patching immediately. EPSS: 0.4%.

Task Management System CVE-2026-19342

Q: What is the CVSS score of CVE-2026-19342?

CVE-2026-19342 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54911 MEDIUM

Improper Authentication (CWE-287)

2026-08-09 VulDB

GHSA-cw8q-38rc-x37p

PHP Authentication Bypass Task Management System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable login bypass with no privileges or interaction required; Low C/I/A reflects partial application-scope impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 09, 2026 - 08:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 09, 2026 - 08:01 vuln.today

CVE Published

Aug 09, 2026 - 07:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Password results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.

Technical ContextAI

The affected product is code-projects Task Management System 1.0, a PHP-based web application identified by CPE cpe:2.3:a:code-projects:task_management_system:*:*:*:*:*:*:*:*. The vulnerability resides in the Login component at /index.php, where the Password parameter is insufficiently validated before being used in authentication logic. CWE-287 (Improper Authentication) encompasses a family of flaws including SQL injection in login queries, PHP loose type comparison (e.g., using instead of = when evaluating password hashes, enabling type juggling bypasses), or outright logic errors that allow credential verification to be skipped. The wildcard CPE version suggests NVD has not confirmed a fixed release, indicating the flaw may affect all distributed versions of the application sourced from code-projects.org.

RemediationAI

No vendor-released patch has been identified at time of analysis - the wildcard CPE version and absence of a vendor advisory or fix commit indicate no official corrective release exists. As the primary compensating control, administrators should immediately restrict internet access to the /index.php login endpoint by placing the application behind a VPN or authenticated reverse proxy, preventing unauthenticated external access to the vulnerable parameter handler. If temporary removal from internet-facing infrastructure is feasible, this is the most effective risk reduction. Deploying a web application firewall (WAF) rule targeting anomalous Password parameter patterns may reduce automated exploitation attempts but does not remediate the underlying flaw and carries a risk of false positives on legitimate login traffic. The VulDB advisory at https://vuldb.com/vuln/387178 and the exploit report at https://github.com/littleRain1355/PHPissue/issues/1 should be monitored for patch availability updates.