CVE-2026-2083: code-projects Social Networking Site 1.0 SQL Injection in delete_post.php

Overview

CVE-2026-2083 describes an SQL injection weakness (CWE-89) in code-projects Social Networking Site 1.0. The record places the flaw in the delete_post.php file, where the ID argument is not handled safely before being used in a database query.

Impact

An attacker who can reach the application over the network may be able to interact with its database through the affected parameter.
The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network access, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
The actual data exposure or modification depends on the application's database configuration, which is not described in the record.

Affected products and versions

Code-projects Social Networking Site, version 1.0, as listed in the record.
The record does not list other affected versions and no fixed version is provided.
The product's project page is referenced at https://code-projects.org/ but the record does not describe its current status.

Exploitation status

The record states that an exploit has been released to the public and may be used for attacks.
CISA KEV does not list this CVE, so no confirmed active exploitation is recorded in the sources consulted.
Organizations should treat the public availability of an exploit as raising the urgency of remediation, even without confirmed in-the-wild use.

Remediation and mitigation

No vendor fix is listed in the record. Check the product's source and vendor channels for an updated version or an official correction.
If no fix exists, consider removing or disabling the affected functionality until a secure version is in place.
Restrict access to administrative and content-management pages, and place such applications behind controls that limit exposure to untrusted networks.
Apply the principle of least privilege to the database account used by the application, limiting its rights to what is strictly necessary.
Review the code path for parameterized queries and input validation as a development task; this is a defensive change for the maintainers.

Detection guidance

Review web server and application logs for requests to delete_post.php with unusual or malformed values in the ID parameter.
Monitor database logs for errors or unexpected query patterns originating from the web application account.
Alert on spikes of error responses from the affected endpoint, as these may indicate probing.

Limitations of the available information

The record does not identify the exact vulnerable code, the parameter validation logic, or the affected function name.
No fixed version, vendor advisory or patch is provided in the record.
Scores differ among providers: NVD assigns 9.8 under CVSS 3.1, while the CNA (VulDB) lists 7.3 under CVSS 3.1, 7.5 under CVSS 2.0 and 5.5 under CVSS 4.0.
The EPSS probability is 0.00376 with a percentile of 0.29666 as recorded; this indicates a low estimated likelihood of exploitation in the near term but does not confirm exploitation.

Frequently asked questions

What is the vulnerability in CVE-2026-2083?

It is an SQL injection weakness (CWE-89) in the delete_post.php file of code-projects Social Networking Site 1.0, triggered through the ID argument.

Is this CVE being actively exploited?

CISA KEV does not list it, and the sources consulted do not confirm active exploitation. The record does state that a public exploit has been released.

Is there an official fix?

The record does not list any fixed version or vendor patch. Check the vendor or project channels and consider disabling the affected functionality if no fix is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.