What is the CVSS score of CVE-2026-37338?

CVE-2026-37338 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Simple Music Cloud are affected by CVE-2026-37338?

SourceCodester Simple Music Cloud Community System v1.0 contains a critical SQL injection vulnerability in the /music/view_user.php endpoint that permits unauthenticated remote database manipulation…

How to fix or mitigate CVE-2026-37338?

Within 24 hours, immediately inventory all systems running SourceCodester Simple Music Cloud Community System v1.0 and assess network exposure; consider isolating the application from external access if not business-critical. Within 7 days, contact SourceCodester for guidance on available patched versions, and deploy web application firewall (WAF) rules to restrict and monitor access to the /music/view_user.php endpoint. Within 30 days, complete migration to a patched version or replacement system; if upgrade is unavailable, implement strict network segmentation, restrict access to trusted internal networks only, and implement comprehensive input validation controls if application source code is accessible.

Simple Music Cloud CVE-2026-37338

EUVD-2026-23252 CRITICAL

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-q6fh-hrhq-5x64

PHP SQLi

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

8.2 HIGH

Unauthenticated remote SQLi on a data-view endpoint yields full DB read (C:H); write impact (I:L) is possible but unconfirmed and no availability effect, consistent with SSVC 'partial'.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:36 vuln.today

CVSS changed

Apr 16, 2026 - 17:22 NVD

9.4 (CRITICAL)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23252

CVE Published

Apr 16, 2026 - 15:17 nvd

CRITICAL 9.4

DescriptionCVE.org

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.

AnalysisAI

SQL injection in SourceCodester Simple Music Cloud Community System v1.0 lets remote attackers manipulate backend database queries through the /music/view_user.php endpoint. Per the CVSS vector (PR:N), no authentication is required, and publicly available exploit code exists (SSVC exploitation: poc), though it is not listed in CISA KEV and carries a very low EPSS probability (0.03%, 8th percentile). Exploitation can expose or tamper with stored user and application data.

Technical ContextAI

This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in a PHP web application backed by a relational database (typically MySQL/MariaDB in the LAMP-stack SourceCodester ecosystem). The vulnerable script /music/view_user.php passes attacker-controllable input (most likely a user identifier parameter) directly into a SQL query without parameterization or sanitization, allowing query structure to be altered. Because the injection occurs in a data-retrieval ('view') endpoint, an attacker can typically leverage UNION-based, error-based, or blind boolean/time-based techniques to extract arbitrary rows from the database. EUVD tracks this as EUVD-2026-23252; affected version metadata there is listed only as 'n/a'.

RemediationAI

No vendor-released patch identified at time of analysis; the only reference is an independent researcher report (https://github.com/mt-0505/cve-report/blob/main/sourcecodester/simple-music-cloud-community-system/SQL-4.md), and no fixed version number is available. As compensating controls, restrict or remove the /music/view_user.php endpoint from untrusted network exposure (e.g., place the application behind authentication or an IP allowlist), which prevents anonymous access at the cost of blocking legitimate public users; deploy a WAF rule to block SQL metacharacters and UNION/comment patterns on the view_user parameters, accepting possible false positives on legitimate input; and at the code level, rewrite the affected query to use parameterized/prepared statements and enforce input validation on the user identifier. Since this is a demonstration-grade application, consider retiring it from production entirely if a maintained alternative exists.