Online Music Site CVE-2026-11490

The Online Music Site application must be deployed and network-reachable to the attacker, with the /Frontend/Search.php endpoint accessible - this is a frontend page expected to be reachable without authentication in a normal deployment. No special configuration toggle is required beyond having the application installed in its default state; the vulnerability is in the shipped code path handling the Category argument. Limiting factors are narrow: the product itself is niche (a code-projects educational PHP app), so realistic exposure depends on whether instances are exposed to the internet rather than any per-deployment hardening setting.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N reflects a network-reachable, unauthenticated, no-user-interaction attack - the highest-risk exposure profile - though the impact components (C:L/I:L/A:L) reduce the base score to 7.3 (High) rather than Critical, reflecting partial rather than full database compromise modeled by NVD. The exploit maturity is marked Proof-of-Concept (E:P) with a Reasonable report confidence (RC:R), and a public PoC reference on GitHub corroborates this. EPSS data was not provided in the input, and the CVE is NOT listed in CISA KEV, so this should be treated as 'publicly available exploit code exists' rather than confirmed active exploitation. The realistic risk is moderate-to-high for any internet-exposed instance: code-projects software is typically deployed by students and small sites, so widespread targeting is plausible but unlikely to be a strategic priority compared to enterprise-grade SQLi.

An attacker discovers a publicly reachable Online Music Site instance via shodan or Google dorking for the application's distinctive UI, then sends a crafted HTTP GET or POST request to /Frontend/Search.php with a malicious payload in the Category parameter (e.g., a UNION SELECT or time-based blind injection). Because a public PoC is available on GitHub, the attack requires minimal skill and can be executed with sqlmap or a direct curl request to extract user credentials, song metadata, or admin session data.