CVE-2026-7238
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
code-projects Online Music Site 1.0 has a vulnerability in /Administrator/PHP/AdminUpdateAlbum.php where manipulation of the txtimage argument leads to unrestricted upload. Remote exploitation is possible, and the exploit has been published and may be used.
Risk Assessment
An attacker could upload malicious files such as webshells, leading to remote code execution and server compromise. The risk is high due to the publicly available exploit.
Recommendation
Update Online Music Site to a version containing the fix or remove the vulnerable file. If updating is not possible, restrict access to the admin panel and implement file upload validation.
Other vulnerabilities in Online Music Site
See all- CVE-2026-13567Medium
A cross-site scripting vulnerability has been discovered in code-projects Online Music Site 1.0 in the file /Frontend/Feedback.php. Manipulation of the fname, femail, faddress, or fmessage arguments allows remote injection of malicious scripts.
- CVE-2026-11490High
Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10178High
An SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminEditAlbum.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-10171Medium
Vulnerability in code-projects Online Music Site 1.0 allows SQL Injection by manipulating the ID argument in the file /Administrator/PHP/AdminUpdateAlbum.php.
Original NVD description (English source)
A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulation of the argument txtimage causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS