CVE Intelligence
Analysis AI-assisted

CVE-2026-2132: SQL Injection in code-projects Online Music Site 1.0

A SQL injection flaw (CWE-89) has been reported in code-projects Online Music Site 1.0, in a file under the Administrator area, through the txtcat argument. NVD lists a CVSS 3.1 base score of 9.8 and the record says the attack can be carried out remotely. The record states that a public exploit has been released, but the CVE is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The NVD and CNA data describe an SQL injection weakness (CWE-89) in code-projects Online Music Site 1.0. According to the record, the issue lies in how the file /Administrator/PHP/AdminUpdateCategory.php processes input supplied through the txtcat argument. The CVE was published on 2026-02-08 and its source status is Analyzed.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • The CNA vuldb.com reports additional scores of 7.3 (CVSS 3.1), 7.5 (CVSS 2.0) and 5.5 (CVSS 4.0).
  • SQL injection in general can allow unauthorized reading or modification of database content. The specific consequences in this product are not described in the record.

Affected products and versions

  • The affected product field lists Fabian Online Music Site, version 1.0, while the description names code-projects Online Music Site 1.0. This naming difference should be verified against the vendor site code-projects.
  • No fixed version is listed in the record. This is unknown and does not mean that no fix exists.

Exploitation status

  • The record marks the CVE as not listed in CISA KEV, so no confirmed active exploitation is established by this data.
  • The description states that the exploit has been released to the public and may be used for attacks. The record references a public issue-tracker entry tagged as Exploit: GitHub issue.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • No vendor fix is identified in the record. Until a fix or an authoritative statement from the maintainer is confirmed, treat the product as unpatched.
  • Restrict access to administrative functions to trusted networks and accounts, and remove or disable the application if it is not required.
  • Limit the exposure of the application to the internet, and review whether this software is used in production.
  • Ask the developer or maintainer to apply input validation and parameterized queries in the affected code, and verify the change after it is made.
  • Check third-party tracking entries such as the VulDB entry for updates.

Detection guidance

  • Review web server and application logs for unusual requests to the administrative category update functionality.
  • Monitor database errors and abnormal query patterns originating from the web application.
  • Watch for unexpected changes to category or content records.

Limitations of the available information

  • The record contains no fixed version, vendor patch or vendor advisory.
  • The product name differs between the description and the affected product field.
  • The EPSS entry carries a date (2026-10-13) that is later than the publication date; its meaning should be checked before it is relied upon.
  • Exploit details are intentionally not reproduced here.

Frequently asked questions

What is the vulnerability in CVE-2026-2132?

The record describes an SQL injection weakness (CWE-89) in code-projects Online Music Site 1.0, affecting the file /Administrator/PHP/AdminUpdateCategory.php through the txtcat argument.

Is CVE-2026-2132 being actively exploited?

CISA KEV does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted. The description states that a public exploit has been released.

Is there a fixed version available?

The record lists no fixed version or vendor patch. This is unknown, so the product should be treated as unpatched until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.