CVE-2026-0546 is a high severity (CVSS 7.3) SQL injection in code-projects Content Management System 1.0. The search.php file mishandles the Value input, and the exploit is described as public. The record names no fixed version and no vendor advisory, so remove the application from public exposure and fix the code.
What's affected
The record lists code-projects Content Management System version 1.0 only. The affected file is search.php, and the affected input is Value. It names no fixed version and links no vendor advisory, so do not assume a patch exists.
How to check if you're exposed
This is application code, so check the deployment.
- Confirm whether you run Content Management System 1.0. The version is usually in the project files or the page footer.
- Search the code for search.php and read how Value is used.
- Review web server logs for requests to search.php with unusual values.
- Check whether the application is reachable from the internet.
What to do now
- Find every deployment of Content Management System 1.0, including test and demo copies.
- Take it off the public internet, or restrict access to trusted addresses, until the code is fixed.
- Change the code behind search.php to use prepared statements for Value, and review the other pages for the same pattern.
- Run the database user with the least rights the application needs, and keep it separate from admin accounts.
- Review web and database logs for odd values in this parameter and for query errors.
Why it matters
The record tags CWE-74 (injection) and CWE-89 (SQL injection). A request value is placed into a database query without proper handling, so the value can change the query. Parameterised queries (prepared statements) remove the problem at its source, and a database account with only the rights the page needs limits the damage.
The CVSS vector needs no login and no user interaction, with low impact in each of confidentiality, integrity and availability, which gives 7.3. The record says an exploit has been published. It does not mark the CVE as CISA KEV, and it names no incident.
Quick check
What is the real fix for this bug?
Use prepared statements for every query that includes request data, and apply least privilege to the database account.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Referenced by the CVE record (not independently fetched for this guide):
Last reviewed: 19 October 2026.
