CVE-2026-2212: code-projects Online Music Site 1.0 SQL Injection

Overview

CVE-2026-2212 is a SQL injection issue (CWE-89) reported in the code-projects Online Music Site 1.0 application. According to the record, the flaw is in the file /Administrator/PHP/AdminEditCategory.php and is triggered through manipulation of the ID argument. The vendor site is code-projects.org, and the entry is also tracked by VulDB.

Impact

• SQL injection generally allows an attacker to influence database queries. The record does not detail exactly which data could be read or changed.
• The CVSS 3.1 vector reported by NVD (AV:N, AC:L, PR:N, UI:N) describes remote, low-complexity access requiring no privileges or user interaction, with high impact to confidentiality, integrity and availability.
• Inference: the impact in a real deployment depends on the database configuration and on how the administrative path is exposed, which the record does not describe.

Affected products and versions

• The record lists the affected product as version 1.0 of the Online Music Site. The affected field names the vendor as Fabian, while the description names code-projects. This inconsistency should be checked against the vendor's own materials.
• No fixed version is listed in the record. This does not mean that no fix exists; it means none was provided in the sources consulted.

Exploitation status

• The record states that the exploit is publicly available. A GitHub issue tagged as exploit-related is among the listed references.
• The CVE is not listed in CISA KEV in this record. No confirmed exploitation in the wild appears in the sources consulted.
• The EPSS probability in the record is low (0.00376). EPSS is a statistical estimate of exploitation likelihood and does not confirm activity.

Remediation and mitigation

• No vendor fix is identified in the record. Check whether the application is still in use and whether a maintained version or vendor-supplied fix exists.
• Restrict access to the administrative directory to trusted networks and accounts using web server or network controls until the code has been reviewed.
• Developers should validate input and use parameterized queries in the affected script.
• If the project is not required, remove or disable it.

Detection guidance

• Review web server logs for requests to the affected administrative script with unusual or non-numeric values in the ID parameter, and for database error messages returned in responses.
• Monitor the database account used by the web application for unexpected query patterns.
• Detection at this level is heuristic. The absence of alerts does not prove that the system was not affected.

Limitations of the available information

• The record contains no vendor advisory, no fixed version and no vendor confirmation.
• The vendor name differs between the affected field and the description.
• CVSS scores differ across providers: NVD gives 9.8 under CVSS 3.1, while the CNA entries include 7.3 under 3.1, 5.5 under 4.0 and 7.5 under 2.0.
• Technical details beyond public availability of an exploit are not provided here, and this analysis did not verify the vulnerability independently.

Frequently asked questions

Is CVE-2026-2212 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit is available.

Is there a fixed version of the affected software?

No fixed version is listed in the record. That does not confirm that a fix is absent, so check the vendor and project materials directly.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.