Which versions of Online Music Site are affected by CVE-2026-11490?

SQL injection vulnerability in code-projects Online Music Site 1.0 allows unauthenticated attackers to execute arbitrary SQL commands directly against the backend database through the search…

Is there a public PoC exploit available for CVE-2026-11490?

Yes, a public proof-of-concept exploit is available for CVE-2026-11490. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11490?

24 hours: Inventory all systems running code-projects Online Music Site 1.0 and immediately restrict network access to the application if operationally feasible. 7 days: Deploy Web Application Firewall rules to block SQL injection patterns in the Category parameter of /Frontend/Search.php; implement input validation and parameterized queries in the application code. 30 days: Either migrate to a maintained alternative platform or conduct comprehensive security remediation of the entire codebase including all user input handling; revalidate in controlled environment before production return.

Online Music Site CVE-2026-11490

Q: What is the CVSS score of CVE-2026-11490?

CVE-2026-11490 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35021 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-hm9j-2qrx-qv5r

PHP SQLi Online Music Site Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 07:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 07:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 06:51 vuln.today

DescriptionCVE.org

A vulnerability was determined in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Frontend/Search.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Online Music Site 1.0 allows remote unauthenticated attackers to manipulate the Category parameter in /Frontend/Search.php to execute arbitrary SQL commands against the backend database. Publicly available exploit code exists (disclosed via GitHub), increasing the practical risk despite the small footprint of this PHP application. No active exploitation has been confirmed in CISA KEV at the time of analysis.

Technical ContextAI

The affected product is code-projects Online Music Site version 1.0 (cpe:2.3:a:code-projects:online_music_site), a PHP-based web application typically used in academic or hobbyist deployments. The root cause maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied input from the Category HTTP parameter is concatenated into a SQL query within Search.php without parameterization or proper escaping. PHP applications of this class frequently use mysqli or legacy mysql_* APIs with direct string interpolation, allowing union-based, boolean-based, or time-based blind SQL injection techniques to extract data or modify the database.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects rarely issues formal advisories or versioned security fixes. Operators should apply manual remediation in /Frontend/Search.php by replacing string-concatenated SQL with prepared statements using mysqli_prepare or PDO bound parameters for the Category argument, and validate that Category matches an expected whitelist of values. As compensating controls until code is fixed, deploy a WAF rule blocking common SQLi patterns on the Category query parameter (trade-off: may break legitimate values containing quotes or SQL keywords), restrict the application to internal networks via firewall or VPN if it is not required to be public-facing, or take the application offline if it is non-production. Monitor vuldb.com/vuln/369110 for any vendor response and review the public PoC at https://github.com/xiaobbai/CVE1/issues/1 to validate detection signatures.