CVE Intelligence
Analysis AI-assisted

CVE-2026-1535: code-projects Online Music Site SQL Injection in AdminReply.php

CVE-2026-1535 describes an SQL injection issue in the code-projects Online Music Site 1.0, located in /Administrator/PHP/AdminReply.php through the ID argument. NVD rates it CVSS 3.1 9.8 (Critical), and the record states that a public exploit has been disclosed. The CISA KEV catalog does not list it, and the record provides no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CVE record describes an SQL injection issue in the code-projects Online Music Site 1.0, in the file /Administrator/PHP/AdminReply.php, where the ID argument is handled unsafely. The CNA classifies the weakness as CWE-74 (Injection).

Impact

  • NVD scores the issue at CVSS 3.1 9.8 (Critical), with network attack vector, low complexity, no privileges required and no user interaction, and high impact on confidentiality, integrity and availability.
  • The CNA VulDB provides other scores: 5.5 under 4.0, 7.3 under 3.1 and 7.5 under 2.0.
  • SQL injection in general can allow unauthorized reading or modification of database content. The record does not describe the specific consequences observed for this application.

Affected products and versions

  • The record lists version 1.0. The affected entry names Fabian Online Music Site, while the description names code-projects Online Music Site. This discrepancy should be verified against the vendor or project references.
  • The record does not list a fixed version.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation is stated in the sources consulted.
  • The record states that the exploit has been publicly disclosed and may be used.

Remediation and mitigation

  • The record points to a mitigation entry in a public issue tracker. The content of that page was not reviewed for this analysis.
  • Restrict access to administrative paths to trusted networks and accounts.
  • Ask the vendor or project maintainer for an official fix, and apply it when available.
  • If no fix is available, consider disabling or isolating the application until it can be reviewed.

Detection guidance

  • Review web server logs for unusual or malformed requests to AdminReply.php.
  • Monitor database errors that originate from this application.
  • Audit administrative accounts and recent changes to data managed by the application.

Limitations of the available information

  • The record contains no fixed version and no vendor advisory.
  • The product name differs between the description and the affected list.
  • EPSS and SSVC data are absent, so the likelihood of exploitation is unknown.
  • The record does not reconcile the different CVSS scores from NVD and the CNA.

Frequently asked questions

What is CVE-2026-1535?

It is an SQL injection issue in the code-projects Online Music Site 1.0, affecting the ID argument in /Administrator/PHP/AdminReply.php, according to the record.

Is this CVE known to be exploited in the wild?

The record does not list it in the CISA KEV catalog, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Is there a fixed version?

The record does not list a fixed version. It points to a mitigation entry in a public issue tracker, and the vendor or maintainer should be asked for an official fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.