CVE Intelligence
Analysis AI-assisted

CVE-2026-2211: code-projects Online Music Site SQL Injection via ID Argument

CVE-2026-2211 is an SQL injection weakness in code-projects Online Music Site 1.0, tied to an administrative category-deletion function where the ID argument is not handled safely. NVD scores it 9.8 (CVSS 3.1, critical), the CNA VulDB scores are lower, and the record states that a public exploit exists. The record does not show a KEV listing, confirmed exploitation in the wild, or a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2211 describes an SQL injection weakness (CWE-89) in code-projects Online Music Site 1.0. According to the CNA record, manipulating the ID argument of an administrative category-deletion function can lead to SQL injection, and the attack can be carried out remotely.

Impact

  • Confirmed by the record: manipulation of an argument can lead to SQL injection.
  • NVD assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high impact to confidentiality, integrity and availability.
  • Inference: because the flaw sits in an administrative function, consequences could include unauthorized reading or modification of database content. The sources do not detail which data would be exposed.

Affected products and versions

  • The description identifies code-projects Online Music Site 1.0.
  • The affected product field in the record lists Fabian Online Music Site, version 1.0. The vendor name differs from the description, so this should be verified.
  • No fixed version is listed in the record.

Exploitation status

  • The record states that the exploit has been publicly disclosed and may be utilized.
  • The record shows CISA KEV listed as false, so this CVE is not recorded there.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no vendor fix. Check the project or vendor site for updates. If none exists, consider removing the application or restricting its use.
  • Restrict access to administrative paths to trusted networks and require strong authentication for administrative functions.
  • Apply server-side input validation and parameterized queries in the affected code, and have a developer review the component.
  • A web application firewall may serve as a temporary compensating control, but it is not a substitute for a code fix.

Detection guidance

  • Review web server logs for unusual requests to administrative category-management endpoints, especially with abnormal values in ID parameters.
  • Monitor database error messages and unexpected spikes in query volume.
  • Inventory whether this application exists in your environment, since the record covers this single product.

Limitations of the available information

  • No fixed version, vendor advisory or patch is identified in the record.
  • Scores differ by provider: NVD 9.8 (CVSS 3.1); VulDB 7.3 (CVSS 3.1), 5.5 (CVSS 4.0) and 7.5 (CVSS 2.0).
  • The EPSS probability is 0.00376 with a percentile of 0.29664, dated 2026-10-13 in the record.
  • The vendor name is inconsistent between the description and the affected product field.
  • The exploit reference is a public issue-tracker entry. Its contents were not analyzed here.

Frequently asked questions

Is there a fix for CVE-2026-2211?

The record lists no fixed version. A missing fix entry does not prove that no fix exists, so check the project or vendor site and apply input validation and parameterized queries in the affected code.

Is this vulnerability being actively exploited?

The record says the exploit is publicly disclosed, but this CVE is not listed in CISA KEV and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.