Which versions of Online Music Site are affected by CVE-2026-10178?

SQL injection in code-projects Online Music Site 1.0 enables remote attackers to access and modify the administrative database without authentication.

Is there a public PoC exploit available for CVE-2026-10178?

Yes, a public proof-of-concept exploit is available for CVE-2026-10178. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10178?

24 hours: Restrict network access to /Administrator/ path to approved IP ranges only; implement authentication rate limiting. 7 days: Deploy Web Application Firewall with SQL injection signature blocking; audit database logs for exploitation attempts. 30 days: Prepare migration plan to patched code-projects version when released; implement parameterized queries in AdminEditAlbum.php as interim patch.

Online Music Site CVE-2026-10178

Q: What is the CVSS score of CVE-2026-10178?

CVE-2026-10178 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33498 MEDIUM

SQL Injection (CWE-89)

2026-05-31 VulDB

GHSA-pgqf-5p6f-7qwq

PHP SQLi Online Music Site Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 31, 2026 - 11:22 NVD

HIGH MEDIUM

CVSS changed

May 31, 2026 - 11:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 31, 2026 - 11:00 vuln.today

DescriptionCVE.org

A vulnerability was detected in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminEditAlbum.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Online Music Site 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of /Administrator/PHP/AdminEditAlbum.php to inject arbitrary SQL queries. Publicly available exploit code exists (disclosed via VulDB submission 819912 and a GitHub issue), though there is no CISA KEV listing and no EPSS data provided to gauge exploitation probability. The vulnerability carries a CVSS 7.3 score reflecting low complexity and no authentication requirement, but only partial CIA impact.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in a PHP-based web application. The affected component, AdminEditAlbum.php, lives under an /Administrator/ path suggesting an admin-facing album editing endpoint, but the CVSS PR:N rating indicates the script does not enforce authentication before processing the ID parameter - a common pattern in code-projects.org tutorial/freeware PHP apps that include admin scripts without access controls. The CPE cpe:2.3:a:code-projects:online_music_site:*:*:* covers all versions, with 1.0 explicitly named. The root cause is direct concatenation of the user-supplied ID query parameter into a SQL statement without parameterized queries or input sanitization.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects.org freeware projects historically receive limited security maintenance, so operators should not assume an upstream fix is forthcoming. As compensating controls, replace the vulnerable SQL construction in /Administrator/PHP/AdminEditAlbum.php with PDO or mysqli prepared statements binding the ID parameter as an integer, cast the ID to an integer before query construction (e.g., intval) which neutralizes the injection at low effort but only protects this single sink, restrict access to the /Administrator/ directory using web server authentication (.htaccess Basic Auth or IP allowlisting) which prevents anonymous access at the cost of breaking legitimate admin workflows from arbitrary networks, and deploy a WAF rule blocking SQL metacharacters on the ID parameter of AdminEditAlbum.php which adds defense but may produce false positives. Monitor https://vuldb.com/vuln/367459 and https://code-projects.org/ for an official fix.