CVE-2026-19919CWE-74CWE-89sql-injection

CVE-2026-19919

High · published August 16, 2026

CVSS v3.1

7.3

EPSS

Percentile

36.3

In the wild

Unconfirmed

What it is

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.00431 · 36.3th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-16T04:16Z

References (7)

https://code-projects.org/ · [email protected]https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul1.md · [email protected]https://vuldb.com/cve/CVE-2026-19919 · [email protected]https://vuldb.com/submit/871811 · [email protected]https://vuldb.com/vuln/390169 · [email protected]https://vuldb.com/vuln/390169/cti · [email protected]https://vuldb.com/submit/871811 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

15 AUG 23:30Z
code-projects Online Shopping System Login login.php sql injection
cvelistv5