CVE-2026-0568 is a high severity (CVSS 7.3) SQL injection in code-projects Online Music Site 1.0. The /Frontend/ViewSongs.php file mishandles the ID input, and the exploit is described as public. The record names no fixed version and no vendor advisory, so remove the application from public exposure and fix the code.
What's affected
The record lists code-projects Online Music Site version 1.0 only. The affected file is /Frontend/ViewSongs.php, and the affected input is ID. It names no fixed version and links no vendor advisory, so do not assume a patch exists.
How to check if you're exposed
This is application code, so check the deployment.
- Confirm whether you run Online Music Site 1.0. The version is usually in the project files or the page footer.
- Search the code for /Frontend/ViewSongs.php and read how ID is used.
- Review web server logs for requests to /Frontend/ViewSongs.php with unusual values.
- Check whether the application is reachable from the internet.
What to do now
- Find every deployment of Online Music Site 1.0, including test and demo copies.
- Take it off the public internet, or restrict access to trusted addresses, until the code is fixed.
- Change the code behind /Frontend/ViewSongs.php to use prepared statements for ID, and review the other pages for the same pattern.
- Run the database user with the least rights the application needs, and keep it separate from admin accounts.
- Review web and database logs for odd values in this parameter and for query errors.
Why it matters
The record tags CWE-74 (injection) and CWE-89 (SQL injection). A request value is placed into a database query without proper handling, so the value can change the query. Parameterised queries (prepared statements) remove the problem at its source, and a database account with only the rights the page needs limits the damage.
The CVSS vector needs no login and no user interaction, with low impact in each of confidentiality, integrity and availability, which gives 7.3. The record says an exploit has been published. It does not mark the CVE as CISA KEV, and it names no incident.
Quick check
What is the real fix for this bug?
Use prepared statements for every query that includes request data, and apply least privilege to the database account.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Referenced by the CVE record (not independently fetched for this guide):
- https://github.com/Limingqian123/CVE/issues/15
- https://code-projects.org/
- https://vuldb.com/?id.339380
Last reviewed: 19 October 2026.
