CVE-2026-0569: code-projects Online Music Site SQL injection in AlbumByCategory.php

Overview

CVE-2026-0569 is an SQL injection vulnerability (CWE-89) affecting the file /Frontend/AlbumByCategory.php in code-projects Online Music Site 1.0. According to the record, manipulating the argument ID leads to SQL injection, and the attack can be launched remotely. The record was published by VulDB on 2026-01-02.

Impact

NVD assigns a CVSS base score of 9.8 (critical), with high impact values for confidentiality, integrity and availability in the vector.
Other scores in the record (from VulDB and other providers) range from 5.5 to 7.5, so the severity depends on the scoring source.
SSVC data in the record marks exploitation as proof-of-concept, automatable as yes and technical impact as partial.
The exact data exposed or modified depends on the database and application configuration, which is not described in the record.

Affected products and versions

Code-projects Online Music Site, version 1.0.
Fabian Online Music Site, version 1.0. The record lists this product too, but the relationship to the code-projects product is not explained.
No fixed version is listed in the record.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation is recorded there. The description states that the exploit has been disclosed to the public and may be used. The references include a GitHub issue tagged as exploit-related. The record's SSVC data labels exploitation as proof-of-concept. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.00387 (percentile 0.31657).

Remediation and mitigation

No vendor fix is listed in the record. Contact code-projects or the relevant maintainers for an updated version or guidance, and treat the lack of a listed fix as unknown rather than as absence of a fix.
Until a fix is confirmed, restrict access to the affected application, especially if it is exposed to the internet.
Apply input validation and use parameterized queries or prepared statements for database access in the affected code.
Limit database account privileges to what the application needs.
Consider a web application firewall as a temporary compensating control, recognizing that it is not a complete substitute for a code fix.

Detection guidance

Review web server and application logs for requests to /Frontend/AlbumByCategory.php with unusual or malformed values in the ID parameter.
Watch for database errors returned to clients or unexpected query behavior from this endpoint.
Check whether the application is publicly reachable and whether it has been modified or inventoried.

Limitations of the available information

The record does not list fixed versions, vendor advisories or patches.
The record does not describe the vulnerable code, the database engine or the exact parameter handling.
The EPSS date in the record (2026-10-23) is later than the publication date and should be verified against the source.
The relationship between the two listed affected products is not explained.

Frequently asked questions

What is CVE-2026-0569?

It is an SQL injection vulnerability (CWE-89) in /Frontend/AlbumByCategory.php of code-projects Online Music Site 1.0, triggered by manipulating the ID argument.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted. The description says the exploit has been publicly disclosed.

Is there a fixed version?

No fixed version is listed in the record. Contact the vendor or maintainers and apply input validation and restricted access in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.