CVE-2026-10171
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in code-projects Online Music Site 1.0 allows SQL Injection by manipulating the ID argument in the file /Administrator/PHP/AdminUpdateAlbum.php.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, database modification, or privilege escalation.
Recommendation
Immediately upgrade the application to a patched version or use parameterized SQL queries and input validation.
Other vulnerabilities in Online Music Site
See all- CVE-2026-13567Medium
A cross-site scripting vulnerability has been discovered in code-projects Online Music Site 1.0 in the file /Frontend/Feedback.php. Manipulation of the fname, femail, faddress, or fmessage arguments allows remote injection of malicious scripts.
- CVE-2026-11490High
Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10178High
An SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminEditAlbum.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.