CVE-2026-11490
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can steal or modify database data, leading to confidentiality and integrity breaches.
Recommendation
Use parameterized SQL queries or input validation in Search.php. Immediately update the application if a patch is available.
Other vulnerabilities in Online Music Site
See all- CVE-2026-13567Medium
A cross-site scripting vulnerability has been discovered in code-projects Online Music Site 1.0 in the file /Frontend/Feedback.php. Manipulation of the fname, femail, faddress, or fmessage arguments allows remote injection of malicious scripts.
- CVE-2026-10178High
An SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminEditAlbum.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-10171Medium
Vulnerability in code-projects Online Music Site 1.0 allows SQL Injection by manipulating the ID argument in the file /Administrator/PHP/AdminUpdateAlbum.php.
Original NVD description (English source)
A vulnerability was determined in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Frontend/Search.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.