Is there a public PoC exploit available for CVE-2026-10171?

Yes, a public proof-of-concept exploit is available for CVE-2026-10171. Prioritise patching immediately. EPSS: 0.0%.

Online Music Site CVE-2026-10171

Q: What is the CVSS score of CVE-2026-10171?

CVE-2026-10171 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33491 LOW

SQL Injection (CWE-89)

2026-05-31 VulDB

GHSA-pr9p-j46f-9gph

PHP SQLi Online Music Site Code Projects

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

May 31, 2026 - 07:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 31, 2026 - 06:59 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Online Music Site 1.0 exposes the administrator backend endpoint /Administrator/PHP/AdminUpdateAlbum.php to database manipulation via an unsanitized ID parameter. Exploitation requires high-privilege (administrator) credentials per CVSS PR:H, meaning only authenticated admins - or attackers who have already compromised an admin account - can trigger the flaw. A public proof-of-concept has been disclosed via GitHub, but no CISA KEV listing exists, and no public exploitation activity has been confirmed at this time.

Technical ContextAI

The affected component is a PHP script (AdminUpdateAlbum.php) within the administrator panel of code-projects Online Music Site 1.0, identified by CPE cpe:2.3:a:code-projects:online_music_site:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the ID parameter supplied via HTTP request is interpolated directly into a SQL query without parameterization or adequate sanitization. This is a classic PHP/MySQL anti-pattern where user-controlled input reaches the database layer without escaping, enabling query structure modification. The wildcard version in the CPE string suggests the vulnerability may not be isolated to version 1.0 alone, though only 1.0 is explicitly named in the description.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Online Music Site 1.0. The upstream fix has not been confirmed via a tagged release or vendor advisory. As the primary remediation, developers should refactor /Administrator/PHP/AdminUpdateAlbum.php to use parameterized queries (prepared statements via PDO or MySQLi) for the ID parameter, eliminating the injection surface entirely. As a compensating control, deploy a web application firewall (WAF) with SQL injection ruleset to filter malicious input targeting the admin endpoints - note this adds operational overhead and may generate false positives. Additionally, restrict access to the /Administrator/ directory to trusted IP ranges or require VPN access, reducing the network attack surface. If the application is not actively maintained, consider decommissioning or replacing it. References: https://vuldb.com/vuln/367425, https://github.com/gtxy114514/CVE/issues/6.