SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection within the file /music/edit_music.php. The flaw allows an attacker to embed arbitrary SQL statements into the query, potentially permitting unauthorized data disclosure, modification, or deletion. This reflects a classic input handling weakness that lacks proper sanitization or parameterized statement usage. The likely attack vector is remote user input via the web interface, as the endpoint accepts user‑provided values without adequate verification. The CVSS score of 9.8 indicates a severe impact, and the EPSS score of < 1% suggests a low probability of exploitation in the current landscape.

The affected product is SourceCodester Simple Music Cloud Community System version 1.0; the vulnerability is confined to the edit_music.php component. No other affected vendors or versions are disclosed.

It is inferred that an attacker could exfiltrate sensitive information, alter or delete records, or compromise the database entirely if successful. Given the remote nature of the vulnerability and its potential for denial of service, the overall risk is significant, although the low EPSS score indicates that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog.