Description
A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminAddAlbum.php. The manipulation of the argument txtimage results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Published: 2026-02-09
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted file upload potentially enabling remote code execution
Action: Apply Patch
AI Analysis

Impact

A vulnerability in AdminAddAlbum.php allows an attacker to upload any file through the txtimage parameter without validation. The lack of file type checks and size limits means attackers can place malicious executables or scripts on the web server, possibly leading to remote code execution, unauthorized data disclosure, or denial of service. The flaw is classified under CWE‑284 and CWE‑434, indicating improper access control and unrestricted file upload weaknesses.

Affected Systems

code‑projects:Online Music Site, version 1.0. The vulnerability is present in the 1.0 release of the Online Music Site application, specifically in the Administrator/PHP/AdminAddAlbum.php component.

Risk and Exploitability

The CVSS score of 5.1 denotes a medium severity vulnerability, while the EPSS score of less than 1% indicates a low current probability of exploitation. The flaw can be triggered from any remote client by submitting a crafted request to the txtimage argument. There are no known authentication prerequisites; the upload endpoint is accessible to administrators, but the lack of proper checks makes exploitation straightforward. This vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 17, 2026 at 21:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Online Music Site application to the latest released version that contains the fix for unrestricted file upload in AdminAddAlbum.php.
  • Configure the upload handling to restrict allowed MIME types and file extensions, and enforce a maximum file size limit.
  • Store uploaded files outside the web document root and sanitize file names to prevent execution of uploaded content.

Generated by OpenCVE AI on April 17, 2026 at 21:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Fabian
Fabian online Music Site
CPEs cpe:2.3:a:fabian:online_music_site:1.0:*:*:*:*:*:*:*
Vendors & Products Fabian
Fabian online Music Site

Mon, 09 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Music Site
Vendors & Products Code-projects
Code-projects online Music Site

Mon, 09 Feb 2026 04:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminAddAlbum.php. The manipulation of the argument txtimage results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Title code-projects Online Music Site AdminAddAlbum.php unrestricted upload
Weaknesses CWE-284
CWE-434
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Music Site
Fabian Online Music Site
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:56:05.555Z

Reserved: 2026-02-08T08:17:36.146Z

Link: CVE-2026-2213

cve-icon Vulnrichment

Updated: 2026-02-09T15:56:34.177Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-09T05:16:24.630

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2213

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T21:45:28Z

Weaknesses