Is there a public PoC exploit available for CVE-2026-19344?

Yes, a public proof-of-concept exploit is available for CVE-2026-19344. Prioritise patching immediately. EPSS: 0.4%.

Task Management System CVE-2026-19344

Q: What is the CVSS score of CVE-2026-19344?

CVE-2026-19344 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54913 MEDIUM

SQL Injection (CWE-89)

2026-08-09 VulDB

GHSA-wvcv-8mp3-7638

PHP SQLi Task Management System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable, unauthenticated, no interaction needed; limited impact consistent with constrained DB account privileges and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 09, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 09, 2026 - 10:01 vuln.today

CVE Published

Aug 09, 2026 - 09:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_count_user.php. The manipulation of the argument task_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.

Technical ContextAI

The affected product is a PHP-based task management web application distributed by code-projects.org, identified by CPE cpe:2.3:a:code-projects:task_management_system:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-89 - Improper Neutralization of Special Elements used in an SQL Command - meaning the task_id GET or POST parameter supplied to /user/comment_count_user.php is interpolated directly into a SQL query without parameterization or escaping. This is a LAMP-stack pattern flaw: PHP script, relational database backend (likely MySQL), no prepared statement usage. The CPE wildcard version (*) indicates no bounded version range has been confirmed beyond version 1.0 referenced in the description.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Task Management System 1.0. The upstream source is available at code-projects.org, but no advisory or patched release is referenced in available intelligence. As an immediate compensating control, restrict access to /user/comment_count_user.php via web server ACLs (e.g., nginx deny or Apache Require directives) to trusted IP ranges only - this eliminates the AV:N attack surface at the cost of reduced availability for remote users. Additionally, implement a web application firewall rule blocking SQL metacharacter patterns in the task_id parameter as a defense-in-depth measure; note this is bypassable and not a substitute for a code fix. The root fix requires replacing string interpolation in the SQL query with parameterized prepared statements (PDO or MySQLi). If source access is available, patch the affected file directly. The exploit is publicly documented at https://github.com/littleRain1355/PHPissue/issues/3 and should be reviewed to understand exact payload patterns for detection rule development.