What is the CVSS score of CVE-2026-37337?

CVE-2026-37337 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Simple Music Cloud are affected by CVE-2026-37337?

SourceCodester Simple Music Cloud Community System v1.0 contains an unauthenticated SQL injection vulnerability in the /music/view_playlist.php endpoint that allows attackers to directly access and…

How to fix or mitigate CVE-2026-37337?

Within 24 hours, identify all instances of SourceCodester Simple Music Cloud Community System v1.0 in your environment and restrict network access to the /music/view_playlist.php endpoint via firewall rules or reverse proxy filtering. Within 7 days, since no vendor patch exists, evaluate and initiate migration to alternative solutions; if the system must remain operational, deploy a Web Application Firewall (WAF) with SQL injection filtering rules and disable the vulnerable endpoint if functionally dispensable. Within 30 days, complete migration to a supported alternative or decommission the affected system entirely.

Simple Music Cloud CVE-2026-37337

EUVD-2026-23251 HIGH

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-3j9x-gmp6-9x73

PHP SQLi

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi (AV:N/AC:L/PR:N) typically enables full database read, so C:H; limited write and no availability impact give I:L/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:36 vuln.today

CVSS changed

Apr 16, 2026 - 18:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23251

CVE Published

Apr 16, 2026 - 15:17 nvd

HIGH 7.3

DescriptionCVE.org

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.

AnalysisAI

SQL injection in SourceCodester Simple Music Cloud Community System v1.0 lets remote attackers inject malicious SQL through the /music/view_playlist.php endpoint, enabling unauthorized database queries against the backend. Per the CVSS vector (PR:N) the flaw is reachable without authentication, and a public technical write-up describing the injection is available on GitHub, though it is not listed in CISA KEV and carries a very low EPSS score (0.03%). SSVC rates exploitation as not-observed but automatable with partial technical impact, marking it as opportunistically scannable rather than actively weaponized.

Technical ContextAI

The affected component is a small open-source PHP/MySQL web application distributed by SourceCodester, a repository of tutorial-grade PHP projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the /music/view_playlist.php script incorporates request-supplied input (typically a playlist identifier parameter) directly into a SQL statement without parameterization or sanitization, allowing the query grammar to be altered. Because the app is tagged PHP/SQLi and uses a MySQL backend, classic UNION-based, error-based, or boolean/time-based blind techniques against the vulnerable parameter are all plausible. The EUVD entry (EUVD-2026-23251) does not enumerate specific version boundaries ('n/a n/a'), but the CVE explicitly names v1.0.

RemediationAI

No vendor-released patch or fixed version was identified at time of analysis, and no official vendor advisory URL is present in the source data. Because SourceCodester projects are typically unmaintained, the durable fix is to rewrite the database access in /music/view_playlist.php to use parameterized queries / prepared statements (PDO or mysqli bound parameters) and to validate that the playlist identifier is strictly numeric before use. As compensating controls until code is fixed: place the application behind a WAF with SQL-injection signatures targeting the view_playlist.php parameter (trade-off: signature bypass is possible and adds a request-inspection layer); restrict network exposure of the app to trusted internal users or a VPN (trade-off: breaks intended public access); and enforce least-privilege on the MySQL account so the web user cannot read unrelated schemas or write files (trade-off: none significant, recommended regardless). Review the public write-up (https://github.com/mt-0505/cve-report/.../SQL-2.md) to confirm the exact injected parameter for targeted input filtering.