Online Shopping System CVE-2026-19919
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Login endpoint is network-accessible with no auth (PR:N, AV:N); SQL injection yields limited data read/write (C:L/I:L); no availability impact described.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
AnalysisAI
SQL injection in code-projects Online Shopping System 1.0 allows remote unauthenticated attackers to manipulate the email parameter on the /login.php endpoint, potentially bypassing authentication and reading or modifying backend database contents. A public proof-of-concept exploit has been published on GitHub, confirming practical exploitability. No patch is available at time of analysis, and the product is a low-prevalence academic/demo codebase with no indication of CISA KEV listing.
Technical ContextAI
The affected component is the PHP-based login handler at /login.php in code-projects Online Shopping System version 1.0, classified under CWE-74 (Injection), which encompasses unsanitized user-controlled input being passed into an interpreter. The specific instantiation is classic SQL injection (SQLi, per tags) via the 'email' POST/GET parameter, indicating the application constructs database queries by string-concatenating user input without parameterized queries or adequate escaping. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms the attack surface is entirely network-accessible with no complexity barriers. No CPE string was provided, but the product is a PHP web application distributed via code-projects.org as a downloadable student/portfolio project.
Affected ProductsAI
code-projects Online Shopping System version 1.0 is the sole confirmed affected product, specifically the /login.php login component. No CPE string was included in the intelligence data. The product is distributed via code-projects.org and is a PHP-based web application. No other versions or products are referenced. Vendor project page: https://code-projects.org/. No formal vendor advisory URL was included in the reference set.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary recommended fix is to replace string-concatenated SQL query construction in /login.php with parameterized queries or prepared statements using PDO or MySQLi, which eliminates the injection surface entirely. As an immediate compensating control, input validation and strict whitelist filtering on the email parameter (e.g., enforcing RFC 5321 email format server-side) can reduce attack surface but does not fully remediate the root cause and may be bypassed by creative payloads. Deploying a Web Application Firewall (WAF) with SQL injection rule sets in blocking mode provides an additional layer but should not substitute for code-level fixes. Administrators running this application in any environment should consider taking the login endpoint offline until a code fix is applied, given the availability of public exploit code. References: POC at https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul1.md; VulDB entry at https://vuldb.com/vuln/390169.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today