CVE-2026-13567
MediumCVSS 4.3Summary
A cross-site scripting vulnerability has been discovered in code-projects Online Music Site 1.0 in the file /Frontend/Feedback.php. Manipulation of the fname, femail, faddress, or fmessage arguments allows remote injection of malicious scripts.
Risk Assessment
An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or steal sensitive data, posing a risk to the organization and its customers.
Recommendation
Immediately update the application to the latest version or apply a patch that prevents XSS, such as input validation and output encoding.
Other vulnerabilities in Online Music Site
See all- CVE-2026-11490High
Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10178High
An SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminEditAlbum.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-10171Medium
Vulnerability in code-projects Online Music Site 1.0 allows SQL Injection by manipulating the ID argument in the file /Administrator/PHP/AdminUpdateAlbum.php.
Original NVD description (English source)
A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.