CVE-2026-10171
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in code-projects Online Music Site 1.0 allows SQL Injection by manipulating the ID argument in the file /Administrator/PHP/AdminUpdateAlbum.php.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, database modification, or privilege escalation.
Recommendation
Immediately upgrade the application to a patched version or use parameterized SQL queries and input validation.
Other vulnerabilities in Online Music Site
See all- CVE-2026-13567Medium
A cross-site scripting vulnerability has been discovered in code-projects Online Music Site 1.0 in the file /Frontend/Feedback.php. Manipulation of the fname, femail, faddress, or fmessage arguments allows remote injection of malicious scripts.
- CVE-2026-11490High
Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10178High
An SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminEditAlbum.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS