CVE Intelligence
Analysis AI-assisted

CVE-2026-0605: code-projects Online Music Site login.php SQL injection

CVE-2026-0605 is an SQL injection flaw in the login.php file of code-projects Online Music Site 1.0, reachable through the username and password arguments. NVD assigns a base score of 9.8 with a network attack vector and no privileges required, and VulDB rates it critical. The record states that an exploit has been publicly disclosed, but the CISA KEV catalog does not list this CVE and the record includes no vendor fix.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0605 affects the login.php component of code-projects Online Music Site 1.0. The record classifies the weakness as CWE-89 (SQL Injection) and states that the username and password arguments are involved. Details come from VulDB and NVD, as linked below.

Impact

  • NVD scores the issue at 9.8 with high impact on confidentiality, integrity and availability, and a network attack vector.
  • Scores from VulDB in the record range from 5.5 to 7.3 depending on the scoring version, so severity ratings differ by source.
  • SSVC lists the technical impact as partial.

Affected products and versions

  • Code-projects Online Music Site, version 1.0.
  • Fabian Online Music Site, version 1.0, also listed in the record for the same vulnerability.
  • No other versions are listed in the record.

Exploitation status

The record states that the exploit has been publicly disclosed. The CISA KEV catalog does not list this CVE, so no confirmed active exploitation appears in the sources consulted. SSVC marks exploitation as proof-of-concept, and the EPSS probability is 0.00441 with a percentile of 0.37267.

Remediation and mitigation

  • The record lists no fixed version. Check code-projects.org for updates and confirm whether the project is still maintained.
  • Until a fix is confirmed, restrict access to the application to trusted networks and remove it from internet-facing exposure where possible.
  • Replace dynamic SQL in the login logic with parameterized queries, and validate input on the server side.
  • Review the database account used by the application and limit its privileges.

Detection guidance

  • Review web server and application logs for login requests with unusual characters or malformed values in the username and password fields.
  • Monitor the login endpoint for authentication anomalies and unexpected database errors.
  • Consider web application firewall rules that alert on SQL syntax in authentication parameters, tuned to reduce false positives.

Limitations of the available information

  • The record does not include a vendor advisory, a fixed version or a patch.
  • The record does not state whether the Fabian Online Music Site listing refers to the same codebase.
  • Exploit details are not reproduced here. The VulDB entry describes the issue.

Frequently asked questions

What is CVE-2026-0605?

It is an SQL injection vulnerability in the login.php file of code-projects Online Music Site 1.0, involving the username and password arguments.

Is there a fixed version?

The record does not list any fixed version or patch. Check the vendor site and confirm the project's maintenance status before relying on an update.

Is this vulnerability being actively exploited?

The record says a public exploit has been disclosed, but the CISA KEV catalog does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.