Which versions of PHP are affected by CVE-2026-2133?

A high-severity vulnerability in the Online Music Site 1.0 administrative interface allows unauthorized modification of category data through the AdminUpdateCategory.php file.

Is there a public PoC exploit available for CVE-2026-2133?

Yes, a public proof-of-concept exploit is available for CVE-2026-2133. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2133?

Within 24 hours: Isolate the /Administrator directory from public access using network segmentation or firewall rules, and review access logs for suspicious activity. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious requests to AdminUpdateCategory.php, disable the administrator interface if not actively needed, and begin inventory of all affected systems. Within 30 days: Contact the vendor for patch availability and release timeline, evaluate migration to patched versions or alternative solutions, and conduct a security audit of administrative functions.

PHP CVE-2026-2133

Q: What is the CVSS score of CVE-2026-2133?

CVE-2026-2133 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Access Control (CWE-284)

2026-02-08 cna@vuldb.com

PHP Authentication Bypass File Upload Online Music Site Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 10, 2026 - 14:50 vuln.today

Public exploit code

CVE Published

Feb 08, 2026 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Unrestricted file upload in Online Music Site 1.0's AdminUpdateCategory.php allows unauthenticated remote attackers to upload arbitrary files by manipulating the txtimage parameter. Public exploit code exists for this vulnerability, enabling potential remote code execution and system compromise. A security patch is not currently available, leaving affected installations vulnerable to active exploitation.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Online Music Site. A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.