What is the CVSS score of CVE-2026-37336?

CVE-2026-37336 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Simple Music Cloud are affected by CVE-2026-37336?

SourceCodester Simple Music Cloud Community System v1.0 contains a SQL injection vulnerability that could enable unauthorized database access or manipulation.

How to fix or mitigate CVE-2026-37336?

Within 24 hours, inventory systems running SourceCodester Simple Music Cloud v1.0 and determine their network exposure, particularly any internet-facing instances. Within 7 days, implement input validation hardening (parameterized queries and prepared statements where feasible), segment network access to the vulnerable /music/view_music.php endpoint, and enable database query logging with alerting on anomalies. Within 30 days, evaluate upgrading to a patched version if available from the vendor, migrating to an actively maintained alternative music platform, or deploying a Web Application Firewall with SQL injection detection rules as a permanent protective layer.

Simple Music Cloud CVE-2026-37336

EUVD-2026-23249 HIGH

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-c54p-hmw4-rrxj

PHP SQLi

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) typically allows full database read, so C:H; limited write/tamper gives I:L and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:37 vuln.today

CVSS changed

Apr 16, 2026 - 18:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23249

CVE Published

Apr 16, 2026 - 15:17 nvd

HIGH 7.3

DescriptionCVE.org

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.

AnalysisAI

SQL injection in SourceCodester Simple Music Cloud Community System v1.0 allows remote attackers to manipulate backend database queries through the /music/view_music.php endpoint. The flaw stems from unsanitized user input reaching a SQL statement (CWE-89), enabling database content disclosure and tampering. No public exploit identified at time of analysis beyond a third-party GitHub vulnerability report, and EPSS is very low (0.03%, 7th percentile), consistent with an obscure hobby-grade PHP application rather than a mass-exploited target.

Technical ContextAI

The affected component is a PHP-based web application (SourceCodester Simple Music Cloud Community System), a small open-source content-management style project typical of the SourceCodester catalog. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a parameter consumed by /music/view_music.php - most commonly a record identifier passed via GET/POST - is concatenated directly into a MySQL query without parameterization or escaping. This lets an attacker break out of the intended query context and inject arbitrary SQL, typically via UNION-based or boolean/time-based blind techniques. No CPE strings were provided in the intelligence, so the exact affected configuration is derived from the vendor/product/version named in the description (v1.0) only.

RemediationAI

No vendor-released patch identified at time of analysis; the product is a small SourceCodester project without a formal advisory or fixed version in the provided data, so remediation relies on code-level and compensating controls. The primary fix is to rewrite the query in /music/view_music.php to use parameterized queries/prepared statements (PDO or mysqli bound parameters) and to cast/validate the record identifier as an integer before use. As interim compensating controls: restrict network access to the application (place it behind authentication or a VPN, since it appears to expose the endpoint unauthenticated), and deploy a web application firewall rule to block SQL metacharacters targeting view_music.php - noting a WAF is bypassable and not a substitute for the code fix. If the application is not business-critical, consider taking it offline until patched. Consult the technical write-up at https://github.com/mt-0505/cve-report/blob/main/sourcecodester/simple-music-cloud-community-system/SQL-1.md for the exact injectable parameter.