The Task Management System by code-projects contains a critical SQL injection vulnerability that allows unauthenticated attackers to gain unauthorized access to backend data.

This is a SQL injection vulnerability (CWE-89) resulting from a failure to validate user input before processing it in database queries. The vulnerability is accessible to unauthenticated remote attackers.

Successful exploitation allows an attacker to bypass authentication, extract sensitive information, or modify the application database. With a CVSS score of 7.3, this vulnerability represents a high risk to business operations and data privacy.

Immediate Action: Contact the vendor or monitor the official project repository for a security patch; if none is available, restrict external access to the application.

Proactive Monitoring: Monitor database query performance and access logs for unusual patterns or signs of SQL injection attacks.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block SQL injection attempts targeting the affected system.

Public Exploit Available: No (no confirmed public exploit found in curated sources).

Because no formal patch is currently identified, users should treat this application as inherently insecure. We strongly recommend limiting exposure by placing the system behind a VPN or firewall and immediately applying any vendor-provided security updates as soon as they are released.