Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-86181— code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting

Quick assessment

Affected

code-projects Task Management System

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 code-projects 任务管理系统 1.0 中发现了一个漏洞。该漏洞影响“用户资料更新”组件中文件 /user/UpdateUserProfile.php 的某个未知功能。对参数的操作会导致跨站脚本攻击（XSS）。攻击者可通过远程发起攻击。该漏洞利用方法已经公开，存在被利用的可能性。

CVSS 3.5 · Low Updated Sep 06, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
code-projects	Task Management System	1.0	`cpe:2.3:a:code-projects:task_management_system::::::::`

II. Public POCs for CVE-2026-86181

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-86181

请登录查看更多情报信息。

Other References for CVE-2026-86181 (1)

🔗 CVE-2026-86181 code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting vdb-entry technical-description

Other References for CVE-2026-86181 (6)

https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Task%20Management%20System%20%60lname%60%20Parameter.md exploit
https://vuldb.com/cve/CVE-2026-86181 third-party-advisory
https://vuldb.com/vuln/399313/cti signature permissions-required
https://vuldb.com/submit/896153 third-party-advisory
https://vuldb.com/submit/897268 third-party-advisory
https://vuldb.com/submit/897266 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-86181

Same Patch Batch · code-projects · 2026-09-06 · 4 CVEs total

CVE-2026-86180	7.3 HIGH	code-projects Task Management System In PHP Login index.php sql injection
CVE-2026-86168	7.3 HIGH	code-projects Content Management System login.php sql injection
CVE-2026-86179	5.3 MEDIUM	code-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure

IV. Related Vulnerabilities

Same product: Task Management System

Same vendor: code-projects

Same weakness: CWE-79

V. Comments for CVE-2026-86181

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-86181— code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-86181

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-86181

III. Intelligence Information for CVE-2026-86181

Other References for CVE-2026-86181 (1)

Other References for CVE-2026-86181 (6)

Same Patch Batch · code-projects · 2026-09-06 · 4 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-86181

Leave a comment