A flaw exists in the Online Music Site that allows an attacker to manipulate the fname argument within Feedback.php, resulting in untrusted input being directly included in a SQL query. The vulnerability is a classic injection that can lead to exposure or modification of the underlying database, compromising the confidentiality and integrity of user data. The weakness is identified as CWE-74 and CWE-89, indicating insufficient filtering of user input before it reaches database statements.

The affected product is code-projects Online Music Site version 1.0, as indexed under the CNA product data and the CPE cpe:2.3:a:fabian:online_music_site:1.0. No additional versions are listed.

The CVSS score of 6.9 indicates a moderate severity for this vulnerability, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild at present. However, the attack can be initiated remotely and an exploit is publicly available, making it a legitimate threat. Because the vulnerability exists in a publicly accessible web application and no official patch has been published, the risk remains heightened until a vendor fix or workaround is applied.