CVE-2026-0852

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Music Site	1.0

References

https://code-projects.org/Product
https://github.com/Learner636/CVE-smbmit/issues/2Exploit, Issue Tracking
https://vuldb.com/?ctiid.340447Permissions Required, VDB Entry
https://vuldb.com/?id.340447Third Party Advisory, VDB Entry
https://vuldb.com/?submit.734136Third Party Advisory, VDB Entry

Timeline

Published: Jan 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-08535.3Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attac CVE-2026-08548.8Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject CVE-2026-08558.8Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to injec CVE-2026-08567.8Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administ CVE-2026-08574.4Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose passw CVE-2026-08586.1Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of i CVE-2026-08597.8TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deseri CVE-2026-08607.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Archi CVE-2026-08618.4Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.3 CVE-2026-08626.1The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all v CVE-2026-08639.9Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unr CVE-2026-08645.5When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the