CVE-2026-86181
Received Received - Intake

Cross-Site Scripting in Task Management System

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86181
EUVD
EUVD-2026-72081

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects task_management_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Task Management System 1.0. It allows an authenticated user to inject malicious JavaScript code via the 'lname' parameter in the user profile update functionality. The injected script is stored in the database and later executed in the browsers of other users who view the affected profile, potentially enabling unauthorized actions or data theft.

Detection Guidance

To detect this vulnerability, inspect the Task Management System for user profile updates. Check if the lname parameter in /user/UpdateUserProfile.php accepts and stores unsanitized input. Look for stored XSS payloads like <script>alert(1)</script> in the last name field of user profiles.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in your browser session when viewing user profiles. This may lead to session hijacking, theft of sensitive data, unauthorized actions on your behalf, or phishing attacks disguised as legitimate parts of the application.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data through session hijacking or data theft. For HIPAA, it may compromise protected health information if exploited in a healthcare context. Both standards require protection against unauthorized data access and breaches.

Mitigation Strategies

Implement server-side validation for the lname parameter to reject scripts. Use output encoding when rendering user-provided data in HTML. Apply prepared statements for database operations to prevent injection. Deploy a restrictive Content Security Policy to limit script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart