Quick answers
- Is CVE-2026-86181 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86181 being exploited in the wild.
- How severe is CVE-2026-86181?
- Low severity, with a CVSS score of 3.5, published 6 September 2026.
- Which products and versions are affected?
- Code-Projects Task Management System 1.0.
- Is there a fix for CVE-2026-86181?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-86181 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-86181?
- Check whether you run Code-Projects Task Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the /user/UpdateUserProfile.php endpoint of the Task Management System version 1.0. The vulnerable component fails to properly sanitize or encode user input in the "lname" (last name) parameter before storing it in the database and displaying it in user profiles. The attack requires authentication but is executed over the network against other users who view the attacker's profile. An attacker can inject arbitrary JavaScript code that will execute in the context of the victim's browser session. No patch information is currently available; mitigation requires applying contextual output encoding, input validation, and implementing Content Security Policy headers.
Affected products
- code-projects Task Management System 1.0
Timeline
- 2026-09-06: disclosed: Vulnerability publicly disclosed; exploit proof-of-concept published on GitHub