Is there a public PoC exploit available for CVE-2026-7238?

Yes, a public proof-of-concept exploit is available for CVE-2026-7238. Prioritise patching immediately. EPSS: 0.0%.

code-projects Online Music Site CVE-2026-7238

Q: What is the CVSS score of CVE-2026-7238?

CVE-2026-7238 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26009 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-28 VulDB

PHP File Upload

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 08:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 08:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 07:30 euvd

EUVD-2026-26009

Analysis Generated

Apr 28, 2026 - 07:30 vuln.today

CVE Published

Apr 28, 2026 - 07:00 nvd

LOW 2.0

DescriptionCVE.org

A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulation of the argument txtimage causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

Unrestricted file upload vulnerability in code-projects Online Music Site 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the txtimage parameter in AdminUpdateAlbum.php, potentially leading to remote code execution. The vulnerability is network-accessible, has publicly available exploit code, and requires high-level administrative credentials to exploit, limiting attack surface primarily to insider threats or compromised admin accounts.

Technical ContextAI

The vulnerability is a classic unrestricted file upload flaw (CWE-434) in a PHP-based web application. The AdminUpdateAlbum.php administrative endpoint fails to validate or sanitize the txtimage file upload parameter, allowing an attacker with administrator privileges to bypass intended upload restrictions. PHP applications with such flaws commonly enable attackers to upload web shells or executable code that executes in the web server context. The CPE indicates the vulnerability affects the entire Online Music Site product line version 1.0 and potentially other versions with incomplete version constraints.

RemediationAI

Implement strict server-side file upload validation in AdminUpdateAlbum.php: validate file type via magic bytes (not just extension), enforce a whitelist of allowed image MIME types (image/jpeg, image/png only), implement file size limits, and store uploads outside the webroot or in a non-executable directory with appropriate permissions (e.g., 644). If the application is version 1.0, contact code-projects.org to determine if a patched version exists; no specific patch version number is confirmed in available references. As an immediate compensating control, restrict access to /Administrator/ paths via firewall/WAF rules to authorized administrative IP ranges only, and enforce strong authentication (multi-factor authentication) for all administrator accounts to reduce credential compromise risk. These controls trade operational convenience (admins may need VPN) for significantly reduced attack surface.