CVE-2026-2212

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /Administrator/PHP/AdminEditCategory.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-22137.2A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file CVE-2026-22144.8A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.ph CVE-2026-22153.7A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of CVE-2026-221538.1An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unau CVE-2026-221545.4An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 throu CVE-2026-221557.5A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through CVE-2026-22164.3A flaw has been found in rachelos WeRSS we-mp-rss up to 1.4.8. Impacted is the function download_export_file of the file apis/tools.py. Exec CVE-2026-221637.8Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows su CVE-2026-221647.5Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. By creating reso CVE-2026-221658.1A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES us CVE-2026-221668.1A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user CVE-2026-221677.8Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory