What is the CVSS score of EUVD-2026-23253?

EUVD-2026-23253 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-23253?

SourceCodester Simple Music Cloud Community System v1.0 contains an unauthenticated SQL injection vulnerability in the genre viewing function that could allow attackers to compromise the entire…

How to fix or mitigate EUVD-2026-23253?

Within 24 hours: Identify all instances of Simple Music Cloud v1.0 in production and take them offline or restrict network access to trusted users only. Within 7 days: Contact vendor SourceCodester for patch timeline or begin migration to alternative music management software; if patched version becomes available, test and deploy immediately. Within 30 days: Complete transition away from v1.0 or implement Web Application Firewall (WAF) rules blocking POST/GET requests to /music/view_genre.php containing SQL keywords ('UNION', 'SELECT', 'DROP', etc.) as interim protection only.

PHP EUVD-2026-23253

| CVE-2026-37339 CRITICAL

SQL Injection (CWE-89)

2026-04-16 cve@mitre.org

GHSA-263f-2q4p-95qq

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 03:22 vuln.today

CVSS changed

Apr 18, 2026 - 03:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23253

Analysis Generated

Apr 16, 2026 - 15:22 vuln.today

CVE Published

Apr 16, 2026 - 15:17 nvd

CRITICAL 9.8

DescriptionCVE.org

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.

AnalysisAI

SQL injection in SourceCodester Simple Music Cloud Community System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the /music/view_genre.php endpoint, enabling complete database compromise including data theft, modification, and potential server takeover. CVSS 9.8 (Critical) with network-exploitable attack vector requiring no authentication or user interaction. EPSS score of 0.01% (2nd percentile) indicates low observed exploitation probability despite critical severity. Publicly available proof-of-concept exists (GitHub repository), lowering exploitation barrier for opportunistic attackers.

Technical ContextAI

SQL injection (CWE-89) is a code injection vulnerability occurring when user-supplied input is improperly sanitized before being incorporated into SQL queries. In this case, the Simple Music Cloud Community System v1.0-a PHP-based web application for music sharing/streaming-fails to validate or parameterize inputs to the view_genre.php script. The vulnerability allows attackers to manipulate SQL query structure, breaking out of intended query logic to execute arbitrary database commands. PHP applications are particularly susceptible when using legacy mysql_* functions or concatenating user input directly into queries instead of prepared statements with bound parameters. The affected system likely uses MySQL/MariaDB as the backend database given the PHP stack, though specific CPE data is not available in NVD records.

RemediationAI

Primary remediation requires migrating to a patched version if available or implementing code-level fixes, though no vendor-released patch has been identified at time of analysis. Organizations using this system should immediately apply compensating controls: implement web application firewall (WAF) rules to block SQL injection patterns in requests to /music/view_genre.php (monitor for evasion attempts using encoding/obfuscation); restrict database account privileges used by the application to minimum required operations (read-only where possible, never GRANT or FILE permissions); deploy network segmentation to prevent database server access from web tier except required ports; enable database query logging to detect exploitation attempts. Long-term mitigation: refactor view_genre.php to use parameterized queries (PDO prepared statements in PHP) instead of string concatenation-developers should review https://github.com/mt-0505/cve-report/blob/main/sourcecodester/simple-music-cloud-community-system/SQL-3.md for specific vulnerable code patterns. If the application is not business-critical, consider decommissioning given the apparent lack of active maintenance. WAF rules may impact legitimate traffic if genre parameters use special characters; test thoroughly in staging environments.