CVE-2026-0852 MEDIUM

CVE-2026-0852: code-projects Online Music Site AdminUpdateUser.php sql injection

Vendor Code-Projects

Product Online Music Site

Weakness CWE-89 · SQLi

Published January 12, 2026

Last update February 23, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Key dates

02Disclosure timeline

January 12, 2026 CVE published

February 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-0852 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2026-27039 WordPress WZone plugin <= 14.0.31 - SQL Injection vulnerability CVE-2026-3747 itsourcecode University Management System add_result.php sql injection CVE-2024-7651 App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search CVE-2022-4963 Folio Spring Module Core Schema Name HibernateSchemaService.java dropSchema sql injection CVE-2025-46460 WordPress Easy Guide plugin <= 1.0.0 - SQL Injection Vulnerability