CVE-2026-75778: code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection
A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Systems running code-projects Task Management System 1.0 are exposed through the Login Form in /index.php, specifically where the email argument reaches Operation::select_with_multiple_condition. The attack can be launched remotely over the network.
What does an attacker need to exploit this issue?
An attacker does not need privileges or user interaction. They can manipulate the email argument supplied to the login form to trigger SQL injection.
What can be done while a fix is unavailable?
The available data does not identify a patch, workaround, or fixed version. If immediate patching is not possible, prioritize restricting untrusted network access to the affected login endpoint and monitor requests to it for suspicious email input.
How can I determine whether my deployment is at risk?
Review whether the deployed application is version 1.0 and whether its login form routes email input through Operation::select_with_multiple_condition in /index.php. Public exploit availability increases the likelihood of exploitation attempts.