Which versions of Online Music Site are affected by CVE-2026-11489?

SQL injection vulnerability in code-projects Online Music Site 1.0 allows unauthenticated attackers to execute arbitrary database queries through the album deletion function; publicly available…

Is there a public PoC exploit available for CVE-2026-11489?

Yes, a public proof-of-concept exploit is available for CVE-2026-11489. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11489?

Within 24 hours: Restrict public network access to affected systems or take offline; deploy WAF rules blocking SQL injection patterns in /Administrator/PHP/AdminDeleteAlbum.php endpoint. Within 7 days: Contact vendor to confirm patch availability timeline; audit database logs for exploitation attempts. Within 30 days: Implement application-level parameterized queries and input validation in AdminDeleteAlbum.php; evaluate migration to actively maintained alternative with vendor security support.

Online Music Site CVE-2026-11489

Q: What is the CVSS score of CVE-2026-11489?

CVE-2026-11489 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35020 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-fq6h-cc6w-qch7

PHP SQLi Online Music Site Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 05:16 vuln.today

DescriptionCVE.org

A vulnerability was found in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminDeleteAlbum.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Online Music Site 1.0 allows remote attackers to manipulate the ID parameter in /Administrator/PHP/AdminDeleteAlbum.php to execute arbitrary database queries. Publicly available exploit code exists (published via GitHub and tracked by VulDB), and the flaw is reachable over the network without authentication per the CVSS vector. There is no public exploit identified as actively used in the wild (not CISA KEV), but the combination of trivial attack complexity and public PoC raises the practical exploitation risk for any exposed deployment.

Technical ContextAI

The affected component is a PHP-based administrative endpoint (AdminDeleteAlbum.php) within the code-projects Online Music Site 1.0 web application (cpe:2.3:a:code-projects:online_music_site:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input from the ID argument is concatenated into a SQL query without proper parameterization or escaping. Code-projects applications are typically small PHP/MySQL educational or hobbyist projects that frequently rely on direct mysqli/mysql_query calls without prepared statements, which is consistent with the tagged classification of PHP and SQLi.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects has not published an advisory or fixed release for this issue per the provided references. As compensating controls, restrict network access to the /Administrator/ directory using web server authentication (e.g., HTTP Basic Auth via .htaccess) or IP allow-listing so the AdminDeleteAlbum.php endpoint is not reachable from untrusted networks; this preserves admin functionality but adds an authentication layer. Apply a WAF rule that blocks SQL metacharacters in the ID parameter for that path (trade-off: may generate false positives for legitimate numeric IDs containing edge cases). For a code-level fix, replace the direct query with a prepared statement using mysqli_prepare/bind_param and cast ID to an integer before use. Monitor https://vuldb.com/vuln/369109 and https://code-projects.org/ for an upstream fix; given the project's small scope, consider migrating off code-projects Online Music Site 1.0 for production use.