Description
A flaw has been found in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Frontend/ViewSongs.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Published: 2026-01-02
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to unauthorized database access and potential data exfiltration
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in an unvalidated argument called ID within the ViewSongs.php file of the code-projects Online Music Site 1.0. This flaw allows attackers to inject arbitrary SQL statements, compromising the integrity and confidentiality of the underlying database. The weakness is a classic injection flaw, as identified by CWE-89.

Affected Systems

Vendors code-projects:Online Music Site run the affected product version 1.0 on their web servers. Only this specific version is confirmed to be vulnerable.

Risk and Exploitability

With a CVSS score of 6.9 the vulnerability is classified as medium severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the KEV catalog does not list this CVE, so no confirmed large‑scale attacks are reported. The likely attack vector is remote, contacting the web application with a crafted ID parameter via the browser or automated scripts. An attacker who succeeds could read, modify, or delete database records, and potentially pivot to other systems if credentials are stored in the same database.

Generated by OpenCVE AI on April 18, 2026 at 08:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade to a version where the SQL injection is fixed.
  • Configure a web application firewall or similar filtering to block suspicious request patterns targeting the ID parameter.
  • Refactor the database access layer in the affected script to use parameterized queries or stored procedures, ensuring all user inputs are properly sanitized.

Generated by OpenCVE AI on April 18, 2026 at 08:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Fabian
Fabian online Music Site
CPEs cpe:2.3:a:fabian:online_music_site:1.0:*:*:*:*:*:*:*
Vendors & Products Fabian
Fabian online Music Site

Mon, 05 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Music Site
Vendors & Products Code-projects
Code-projects online Music Site

Fri, 02 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Frontend/ViewSongs.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Title code-projects Online Music Site ViewSongs.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Music Site
Fabian Online Music Site
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:10:07.229Z

Reserved: 2026-01-02T07:56:10.839Z

Link: CVE-2026-0568

cve-icon Vulnrichment

Updated: 2026-01-02T21:07:59.588Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-02T18:15:54.943

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-0568

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T08:45:41Z

Weaknesses