CVE-2026-0852
Last modified
CVE-2026-0852 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fabian | Online Music Site | 1.0 |
References
- https://code-projects.org/Product
- https://github.com/Learner636/CVE-smbmit/issues/2Exploit, Issue Tracking
- https://vuldb.com/?ctiid.340447Permissions Required, VDB Entry
- https://vuldb.com/?id.340447Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.734136Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-0852?
How severe is CVE-2026-0852?
How do I fix CVE-2026-0852?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-0846A vulnerability in the `filestring()` function of the `nltk.…7.5
- CVE-2026-0847A vulnerability in NLTK versions up to and including 3.9.2 a…7.5
- CVE-2026-0848NLTK versions <=3.9.2 are vulnerable to arbitrary code execu…10
- CVE-2026-0849Malformed ATAES132A responses with an oversized length field…6.8
- CVE-2026-0850A vulnerability was determined in code-projects Intern Membe…7.2
- CVE-2026-0851A vulnerability was identified in code-projects Online Music…9.8
- CVE-2026-0853Certain NVR models developed by A-Plus Video Technologies ha…6.9
- CVE-2026-0854Certain DVR/NVR models developed by Merit LILIN has a OS Com…8.8
- CVE-2026-0855Certain IP Camera models developed by Merit LILIN has a OS C…8.8
- CVE-2026-0856Improper Access Control vulnerability in Mesalvo Meona Clien…7.8
- CVE-2026-0857Cleartext Storage of Sensitive Information in Memory vulnera…6
- CVE-2026-0858Versions of the package net.sourceforge.plantuml:plantuml be…6.1
Are you affected by CVE-2026-0852?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST