Task Management System CVE-2026-19378

Q: What is the CVSS score of CVE-2026-19378?

CVE-2026-19378 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54971 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 cna@vuldb.com

GHSA-32xj-84jw-88p3

PHP XSS

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-reachable XSS requires victim page load (UI:R) and crosses scope into the browser (S:C); low C/I impact; no server availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 00:28 vuln.today

DescriptionCVE.org

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.

Technical ContextAI

The affected product is code-projects Task Management System version 1.0, a PHP-based web application distributed via code-projects.org as an educational/demo project. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): the endpoint /user/CommentSave.php accepts user-supplied values across multiple parameters and renders them in HTML output without adequate encoding or sanitization. The CVSS 4.0 vector confirms the attack is network-accessible (AV:N), low complexity (AC:L), requires no attack prerequisites (AT:N), and no privileges (PR:N), with passive user interaction as the sole limiting factor (UI:P). No CPE string was supplied in the intelligence data, so version scope is inferred from the NVD description alone. The XSS class (CWE-79) encompasses both reflected and stored variants; the description does not explicitly distinguish between them, though the comment-save workflow suggests potential for stored XSS.

RemediationAI

No vendor-released patch has been identified at time of analysis - code-projects.org does not appear to issue formal security advisories or versioned patch releases. The immediate fix is to apply PHP output encoding to all six vulnerable parameters in /user/CommentSave.php using htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering them in any HTML context; this eliminates the injection surface at its root. As a compensating control, deploying a Web Application Firewall with XSS detection signatures (such as ModSecurity with the OWASP Core Rule Set) can intercept common payload patterns, though WAF bypass is feasible for motivated attackers and should not be treated as a permanent fix. Restricting network access to the application to internal or trusted subnets eliminates the remote attack surface entirely, at the cost of reduced accessibility. The public proof-of-concept and technical details are documented at https://github.com/littleRain1355/PHPissue/issues/5 and https://vuldb.com/vuln/387271.