CVE-2026-19378
Received Received - Intake

Cross-Site Scripting in Task Management System 1.0

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulDB

Description
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19378
EUVD
EUVD-2026-54971

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects task_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19378 is an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Code-Projects Task Management System 1.0. It affects the CommentSave.php file, allowing remote attackers to inject malicious JavaScript into task comments without authentication. The flaw occurs because user input is directly inserted into the database without sanitization and later rendered as raw HTML, enabling script execution when viewed by others.

Detection Guidance

To detect this vulnerability, inspect the CommentSave.php file in the Task Management System for improper input handling. Check if user comments are stored without sanitization or authentication. Use browser developer tools to monitor network requests for unsanitized comment submissions. Test by submitting a payload like <script>alert(1)</script> in a comment field and verify if it executes when viewed.

Impact Analysis

This vulnerability could allow attackers to steal sensitive data, perform unauthorized actions on behalf of users, or forge commenter identities. For example, an attacker could inject a script that steals session cookies, leading to account compromise. Users viewing infected comments may unknowingly execute malicious code in their browsers.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized data access or processing, and HIPAA by compromising protected health information if task comments contain such data. It undermines data integrity and confidentiality requirements, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Immediately enforce authentication for comment submissions. Validate and sanitize all user inputs in CommentSave.php. Encode output when rendering comments to prevent script execution. Use prepared statements for database queries to avoid injection. Update the system to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart