Task Management System
Monthly
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.