CVE-2026-1534

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-153409.8lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.CVE-2026-153419.8The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to,CVE-2026-153426.5Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, dCVE-2026-153438.6A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the DependaCVE-2026-153444.9The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and incCVE-2026-153454.3The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versiCVE-2026-153466.1The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parametCVE-2026-153486.3The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, andCVE-2026-153494.3The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versionCVE-2026-15359.8A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /AdministratCVE-2026-153504.3The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due toCVE-2026-153514.9The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injecti
CVE-2026-1534: Critical severity, CVSS 9.8 | Vulnix