EUVD-2026-40082
GHSA-j522-hg24-c99g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable form, no auth needed, but victim must view injected content (UI:R); scope changes to victim browser (S:C) enabling limited session/content impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Cross-site scripting in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to inject malicious scripts via the feedback form's fname, femail, faddress, or fmessage parameters handled by /Frontend/Feedback.php. The CVSS 4.0 score of 2.1 (Low) reflects the UI:P requirement - a victim must interact with the crafted content for the payload to execute, limiting autonomous exploitation. A public proof-of-concept is available via GitHub, though no confirmed active exploitation (CISA KEV) has been recorded.
Technical ContextAI
The affected component is a PHP-based feedback form handler at /Frontend/Feedback.php within code-projects Online Music Site 1.0, identified by CPE cpe:2.3:a:code-projects:online_music_site:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning one or more of the POST parameters - fname (first name), femail (email address), faddress (address), and fmessage (message body) - are echoed back to the browser without adequate HTML encoding or sanitization. This allows an attacker to embed arbitrary JavaScript or HTML that executes in the browser context of any user who views the resulting page. The code-projects.org platform distributes this as a PHP demo/educational project with no formal release or patch lifecycle.
RemediationAI
No vendor-released patch has been identified at time of analysis for code-projects Online Music Site 1.0, consistent with the educational nature of the project and the absence of a formal patch cycle on code-projects.org. Organizations that have deployed this code in any environment should apply output encoding to all user-supplied POST parameters (fname, femail, faddress, fmessage) before rendering them in HTML responses - in PHP this is achieved with htmlspecialchars($value, ENT_QUOTES, 'UTF-8'). Input validation should also be applied server-side (e.g., email format validation for femail, length limits for all fields). Deploying a Content Security Policy (CSP) header with a strict default-src 'self' directive would substantially reduce the exploitability of any remaining XSS surface. As a compensating control, if the feedback submission page is not required for production, disabling or restricting access to /Frontend/Feedback.php via web server configuration (e.g., an Nginx location block returning 403) eliminates the attack surface entirely with no application-side changes required. Full details and the public PoC are referenced at https://github.com/qwessec/CVE/issues/1 and https://vuldb.com/vuln/374575.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today