# CVE-2026-75778: code-projects Task Management System SQL injection in login form

Source: https://junglewise.ai/threats/cve-2026-75778-code-projects-task-management-system-sql-injection-in-login-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75778 · Severity: high · CVSS 7.3 · Published 2026-08-18

A PHP-based task management application contains a SQL injection vulnerability in its login form that allows unauthenticated attackers to bypass authentication and extract sensitive data from the database. An attacker can submit a specially crafted email address to the login form to manipulate database queries and gain unauthorized access to user credentials, task data, and other sensitive information stored in the backend database.

Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-75778 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75778 being exploited in the wild.

**How severe is CVE-2026-75778?** High severity, with a CVSS score of 7.3, published 18 August 2026.

**Which products and versions are affected?** Code-Projects Task Management System 1.0.

**Is there a fix for CVE-2026-75778?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75778 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75778?** Check whether you run Code-Projects Task Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the Operation::select_with_multiple_condition() function located in Classes/init.php. The POST parameter 'email' from the login form (index.php) is concatenated directly into a SQL WHERE clause without parameterization or input escaping: user_email = '".$email."'. This allows attackers to inject arbitrary SQL syntax. The vulnerability is unauthenticated and remotely exploitable via the public login endpoint, requiring no prior session or authorization. Attackers can execute blind SQL injection, error-based SQL injection, or time-based attacks to extract database contents, modify data, or bypass authentication. Remediation requires implementing prepared statements with parameter binding and strict input validation.

## Affected products

- code-projects Task Management System 1.0

## Timeline

- 2026-07-02: disclosed
- 2026-08-18: advisory: CVE-2026-75778 published
- 2026-08-18: other: Public exploit available

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/niaoniaollll/cve/issues/5](https://github.com/niaoniaollll/cve/issues/5)

## Related threats

- [code-projects Task Management System stored cross-site scripting in user profile update](https://junglewise.ai/threats/cve-2026-86181-code-projects-task-management-system-stored-cross-site-scripting)