CVE Intelligence
Analysis AI-assisted

CVE-2026-0567: code-projects Content Management System pages.php SQL injection

A SQL injection flaw in code-projects Content Management System 1.0 affects the pages.php file, where the ID argument is not handled safely. The record describes remote access and a public exploit reference, and NVD rates it critical at 9.8.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL injection flaw in the pages.php file of code-projects Content Management System 1.0. The ID argument is reported as the injection point, and the weakness is classified as CWE-89. Details are summarized in the NVD entry and the VulDB entry.

Impact

  • A successful SQL injection could allow reading or altering database content, depending on how the application and database are configured.
  • NVD rates the issue critical at 9.8, reflecting in its assessment a remotely reachable flaw that requires no privileges and no user interaction.
  • The record does not describe which specific data would be exposed.

Affected products and versions

  • Product: Code-projects Content Management System.
  • Version listed: 1.0.
  • No fixed version is listed in the record. The absence of a fix in the record does not confirm that none exists.

Exploitation status

  • The record states that an exploit is public, and one reference is tagged as an exploit in a GitHub issue.
  • The record shows the CVE is not listed in the CISA KEV catalog, so no confirmed exploitation in the wild is stated in the sources consulted.
  • SSVC data in the record marks exploitation as proof of concept and automatable as yes.

Remediation and mitigation

  • Check whether the vendor or project has published a corrected version. None appears in the record; see the vendor site.
  • Until a fix is confirmed, restrict access to affected installations, limit exposure to untrusted networks, and confirm whether the pages.php endpoint is reachable from the internet.
  • If the software is maintained in-house or can be modified, apply input validation and parameterized queries.
  • Review the privileges of the database account used by the application so it has only what it needs.

Detection guidance

  • Review web server and application logs for unusual requests to pages.php with abnormal values in the ID parameter.
  • Monitor database errors that indicate SQL syntax problems originating from the web application.
  • Consider web application firewall monitoring for SQL injection patterns, recognizing that such patterns can be bypassed.

Limitations of the available information

  • The record does not identify the exact vulnerable function or line.
  • No fixed versions are listed.
  • CVSS scores differ across providers in the record. The NVD score of 9.8 is higher than the VulDB and CNA scores listed.
  • The recorded EPSS probability is 0.00387 with percentile 0.31663.
  • The record does not state how many installations are affected.

Frequently asked questions

Is this vulnerability being exploited in the wild?

The record shows the CVE is not listed in the CISA KEV catalog, so no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit reference exists.

Is a fixed version available?

No fixed version is listed in the record. Check the vendor or project for a corrected release, since the absence of a listed fix does not confirm that none exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.