CVE-2026-0565: code-projects Content Management System delete.php SQL Injection

Overview

CVE-2026-0565 is recorded as an SQL injection weakness (CWE-89) in the file /admin/delete.php of code-projects Content Management System 1.0. According to the record, the issue involves the del argument and can be exercised remotely. The source data is mostly based on the VulDB entry and the NVD record.

Impact

• SQL injection can allow an attacker to interact with the database behind the application in ways the developers did not intend. The exact data exposure or modification possible in this product is unknown from the record.
• The NVD base score is 9.8 (critical), which reflects a high confidentiality, integrity and availability impact in NVD's assessment.
• Other providers in the record score the issue lower, for example VulDB with 6.9 and 7.3 under different CVSS versions. The differences between providers should be considered when prioritizing.

Affected products and versions

• Product: code-projects Content Management System.
• Affected version listed in the record: 1.0.
• The record lists no fixed version. The absence of a fixed version in the record does not confirm that no fix exists; the vendor status is unknown.

Exploitation status

• The record states that an exploit has been made publicly available and could be used for attacks, with a reference to a third-party issue tracker entry.
• The record marks the CVE as not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted.
• The SSVC data in the record gives an exploitation value of poc (proof of concept) and marks the issue as automatable. The EPSS probability is 0.00387 with a percentile of 0.31672.

Remediation and mitigation

• Check whether code-projects Content Management System 1.0 is deployed in your environment, including administrative paths such as /admin/.
• Restrict access to administrative interfaces to trusted networks and users, and require strong authentication for them.
• Apply input validation and parameterized database queries in the affected code path, or replace the component with a maintained alternative if no vendor fix is available.
• Monitor the vendor and the referenced vendor and advisory pages for an official fix.

Detection guidance

• Review web server and application logs for unusual requests to /admin/delete.php, especially requests with unexpected or unusually long values in the del parameter.
• Look for database errors or abnormal query behavior that may indicate injection attempts.
• Use web application firewall or intrusion detection rules where available, tuned to the environment, and validate them before relying on them.

Limitations of the available information

• The record does not describe the exact vulnerable code or the database impact.
• No fixed version, vendor patch or vendor advisory is listed in the record.
• Exploit details are not reproduced here; the record only states that a public exploit exists.
• Scores differ between providers and CVSS versions, and the EPSS date in the record should be checked against the current data before use.

Frequently asked questions

Is CVE-2026-0565 being actively exploited?

The record does not list this CVE in CISA KEV, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit exists and marks exploitation as proof of concept.

Which version is affected?

The record lists code-projects Content Management System version 1.0 as affected. No fixed version is listed in the record.

What should administrators do now?

Restrict access to administrative paths, check whether the product is deployed, apply input validation or parameterized queries where possible, and monitor vendor sources for an official fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.