{"id":"CVE-2026-19919","state":"PUBLISHED","title":"code-projects Online Shopping System Login login.php sql injection","description":"A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.","publishedAt":"2026-08-15T23:30:10.514Z","updatedAt":"2026-08-19T15:10:52.258Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["code-projects Online Shopping System"],"affected":[{"vendor":"code-projects","product":"Online Shopping System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"modules":["Login"]}],"references":["https://vuldb.com/vuln/390169","https://vuldb.com/vuln/390169/cti","https://vuldb.com/cve/CVE-2026-19919","https://vuldb.com/submit/871811","https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul1.md","https://code-projects.org/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19919.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19919","state":"PUBLISHED","datePublished":"2026-08-15T23:30:10.514Z","dateUpdated":"2026-08-19T15:10:52.258Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-15T05:21:42.145Z"},"containers":{"cna":{"title":"code-projects Online Shopping System Login login.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used."}],"affected":[{"vendor":"code-projects","product":"Online Shopping System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"modules":["Login"]}],"references":[{"url":"https://vuldb.com/vuln/390169","name":"VDB-390169 | code-projects Online Shopping System Login login.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/390169/cti","name":"VDB-390169 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19919","name":"CVE-2026-19919 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/871811","name":"Submit #871811 | ONLINE SHOPPING SYSTEM login.php SQL Injection Vulnerability v1 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul1.md","tags":["exploit"]},{"url":"https://code-projects.org/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-15T23:30:10.514Z"},"timeline":[{"time":"2026-08-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-15T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-15T07:27:07.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)","type":"reporter"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/submit/871811","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-19T15:10:43.715581Z","id":"CVE-2026-19919","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-19T15:10:52.258Z"}}]}}}