CVE Intelligence
Analysis AI-assisted

CVE-2026-0570: code-projects Online Music Site SQL injection in Feedback.php

CVE-2026-0570 is a SQL injection flaw (CWE-89) in the file /Frontend/Feedback.php of Online Music Site 1.0 from code-projects, triggered by manipulating the fname argument. The record describes the attack as remote and says a public exploit reference exists, and NVD scores it 9.8 (critical). No fixed version is listed and CISA KEV does not list the CVE in the data consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a SQL injection flaw (CWE-89) in the file /Frontend/Feedback.php of Online Music Site version 1.0 from code-projects. According to the description, manipulating the fname argument results in SQL injection, and the attack can be started remotely. The data was assembled from NVD, the CVE record and VulDB as CNA.

Impact

  • NVD assigns a base score of 9.8 with network attack vector, low attack complexity, no privileges required and no user interaction, and high impact on confidentiality, integrity and availability.
  • Other scores in the record from VulDB and the CNA range from 5.5 to 7.5.
  • SSVC data in the record marks the technical impact as partial and the issue as automatable.

Affected products and versions

  • Code-projects Online Music Site, version 1.0, as named in the record.
  • Fabian Online Music Site, version 1.0, also listed in the record. Whether this is the same software is unknown.
  • No fixed version is listed in the record.

Exploitation status

The record states that the exploit has been made public and could be used, and a public issue-tracker reference is listed among the sources. CISA KEV does not list this CVE in the data consulted, so no confirmed active exploitation appears in the sources consulted. The EPSS probability in the record is 0.00427, with a percentile of 0.35887.

Remediation and mitigation

  • No vendor fix is listed in the record. The absence of a fixed version does not prove that none exists, so check the vendor and the VulDB entry.
  • Restrict access to the affected application, particularly the feedback functionality, to trusted networks until the patch status is clarified.
  • If the project is deployed from the public code and no corrected version is available, consider removing or replacing the feedback component.
  • Apply input validation and parameterized queries in the application code, as general defensive practice against SQL injection.

Detection guidance

  • Review web server and application logs for unusual or malformed values submitted to the feedback page.
  • Monitor database errors returned to the web front end, which can indicate injection attempts.
  • Consider web application firewall rules that flag SQL metacharacters in parameters, tuned to limit false positives.

Limitations of the available information

  • The record does not identify the exact vulnerable code path, the vendor fix status, or any vendor advisory.
  • It is unknown whether the two product names refer to the same software or to different projects.
  • Scores differ between providers, and the record does not explain the reasons for the differences.

Frequently asked questions

What is the vulnerability in CVE-2026-0570?

It is a SQL injection flaw (CWE-89) in the file /Frontend/Feedback.php of code-projects Online Music Site 1.0, triggered by manipulating the fname argument.

Is this CVE being actively exploited?

CISA KEV does not list this CVE in the data consulted, so no confirmed active exploitation appears in the sources consulted. The record does say a public exploit has been made public.

Is there a fixed version?

No fixed version is listed in the record. The absence of a listed fix does not prove that none exists, so check the vendor and the VulDB entry.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.