CVE-2026-10178: SQLi in code-projects Online Music Site 1.0
The National Vulnerability Database (NVD) has disclosed CVE-2026-10178, a high-severity SQL injection vulnerability impacting code-projects Online Music Site 1.0. The flaw resides in the /Administrator/PHP/AdminEditAlbum.php file, specifically within the ID argument manipulation. This vulnerability carries a CVSSv3.1 score of 7.3, indicating a significant risk.
This SQL injection is remotely exploitable, meaning attackers don’t need local access to compromise affected instances. The NVD reports that a public exploit is already available, dramatically increasing the immediacy of the threat. Attackers can leverage this to gain unauthorized access to sensitive data, modify database content, or potentially take full control of the underlying database.
For defenders, the implications are clear: any organization utilizing code-projects Online Music Site 1.0 is directly exposed. The public exploit availability means active exploitation is imminent, if not already underway. Prioritize immediate patching or, if a patch isn’t available, isolate or remove the application from public access. This isn’t a theoretical risk; it’s a critical, actionable threat.
What This Means For You
- If your organization uses code-projects Online Music Site 1.0, you are directly exposed to CVE-2026-10178. Given the public exploit, you need to verify your asset inventory, identify any instances of this application, and either patch immediately or take it offline. Audit logs for suspicious activity around `/Administrator/PHP/AdminEditAlbum.php`.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-10178: SQL Injection in AdminEditAlbum.php
title: CVE-2026-10178: SQL Injection in AdminEditAlbum.php
id: scw-2026-05-31-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-10178 by looking for requests to '/Administrator/PHP/AdminEditAlbum.php' containing SQL injection patterns in the 'ID' or 'id' parameter. This is a direct detection for the initial access vector of this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-31
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-10178/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
uri|contains:
- '/Administrator/PHP/AdminEditAlbum.php'
cs-uri-query|contains:
- 'ID='
- 'id='
cs-uri-query|contains:
- ' OR '
- ' or '
- ' UNION '
- ' union '
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-10178 | Vulnerability | CVE-2026-10178 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 31, 2026 at 14:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-48209: OTRS XSS Exposes Agent Sessions to Attackers
CVE-2026-48209 — An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS)...
CVE-2026-48208 — Denial of Service
CVE-2026-48208 — An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG...
CVE-2026-48189 — OTRS Customer Backend Module Vulnerability
CVE-2026-48189 — An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note...