CVE-2026-0546: code-projects Content Management System SQL injection in search.php
A SQL injection weakness has been reported in the search.php file of code-projects Content Management System 1.0, reachable through the Value argument. The record states the attack can be carried out remotely and that a public exploit has been disclosed, while no fix is listed in the sources consulted. Organizations running this product should treat it as a high priority and apply isolation and input-handling controls.
Overview
A SQL injection weakness (CWE-89) has been reported in an unidentified function of search.php in code-projects Content Management System 1.0. According to the record, input supplied through the Value argument is not handled safely before it reaches the database layer.
Impact
- Confidentiality, integrity and availability may be affected if data can be read or altered through this path. The NVD record lists high impact values for all three areas.
- The record states the issue is remotely reachable, which increases exposure for internet-facing deployments.
- The VulDB entries rate severity lower than NVD, so actual risk depends on deployment context.
Affected products and versions
- Product: code-projects Content Management System.
- Version listed in the record: 1.0.
- Other versions are not listed; whether they are affected is unknown.
- No fixed version is listed in the record.
Exploitation status
- The record states an exploit has been publicly disclosed, and a GitHub issue is tagged as an exploit reference.
- The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog according to the record, and no confirmed exploitation in the wild appears in the sources consulted.
- SSVC metadata in the record marks exploitation status as proof-of-concept level.
Remediation and mitigation
- No vendor fix is documented in the sources consulted. Contact the vendor or project maintainers to confirm whether a corrected version exists.
- Limit access to the affected application, especially from untrusted networks, and remove it from public exposure until it has been reviewed.
- Use parameterized queries and strict input validation in the affected code path, or replace the component with a maintained alternative.
- Review database account privileges so the application account holds only the rights it needs.
Detection guidance
- Review web server and application logs for unusual or malformed requests to search.php, especially Value parameters containing database syntax characters.
- Monitor database errors surfaced to users and unexpected query volume from the web application account.
- Watch for new or modified files in the web root.
Limitations of the available information
- The record does not identify the exact function or the code change that corrects it.
- Fixed versions, vendor statements and full exploitation conditions are not confirmed in the sources consulted.
- EPSS values and scores from different providers differ; they should be treated as context rather than a definitive measure.
Frequently asked questions
Is CVE-2026-0546 known to be actively exploited?
The record does not list the CVE in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does mention that a public exploit has been disclosed.
Is there an official fix?
No fix is listed in the record or the sources consulted. Check with the vendor or project maintainers for a corrected version.
Which versions are affected?
The record lists only version 1.0. Whether other versions are affected is unknown.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.