CVE-2026-1533 is a sql injection flaw in code-projects Online Music Site 1.0, rated 4.7 (medium). The record describes the weak spot as the file /Administrator/PHP/AdminAddCategory.php, reached through the a category field argument. No patched version is listed, so the safe choices are to stop using the software, or to isolate it behind strict controls.
What's affected
- Product: code-projects Online Music Site.
- Affected: 1.0.
- Fixed version: none is listed in the CVE record or the references. Check the vendor or project site for an update.
- Weakness: CWE-89, CWE-74. The record describes it as remotely reachable, and says exploit details have been made public. It is not on the CISA Known Exploited Vulnerabilities list, so the record does not claim active attacks.
How to check if you're exposed
Look for the product in your own estate first. This kind of software is often a downloaded sample or starter project that someone copied onto a server and forgot.
find / -type f -name "AdminAddCategory.php" 2>/dev/null
Search web roots for the file named in the record. If you find it, note whether the site is reachable from the internet, and who owns it.
Next, check the web server logs for requests to that file. Requests with unusual characters in the a category field argument, or a burst of errors from the database, are worth a closer look. They do not prove a breach, but they show whether someone has been probing.
If you cannot find the product, you are probably not running it. Scanning dependencies and deployed files across your repositories is a quick way to be sure.
What to do now
- Decide whether you need Online Music Site at all. If not, remove it from every server.
- If you must keep it, take it off the public internet. Put it behind a VPN, an allowlist or single sign on.
- Have a developer change the code that handles a category field to use parameterized queries, and validate the input type.
- Give the database account used by the application the minimum privileges it needs, and nothing more.
- Add web application firewall rules as a stopgap, and treat them as temporary.
- Review logs and database contents for signs of unwanted access, and rotate any credentials stored in the database.
Why it matters
SQL injection is a long standing class of bug: the program builds a database query by joining text, and some of that text comes from the user. Characters that the database treats as syntax can then change what the query does. The standard cure is a parameterized query, where the database receives the command and the data separately and never confuses them. CWE-89 is the general weakness, and CWE-74 is the broader category for injection into another component.
The record describes a small project, a sample or learning application of the sort downloaded from code sharing sites. Such projects are rarely maintained, and they are often deployed as is. When no fixed version exists, there is nothing to upgrade to. The honest options are to remove the application, to rewrite the affected code yourself, or to restrict who can reach it.
Because exploit details for this entry are public, according to the record, scanners and opportunistic attackers can look for the file path on any server they come across. That is the main reason to act even on a modest score. A reachable site with a database behind it is a target regardless of how small the project is.
Quick check
Is there a patch?
None is listed in the record or the references. Check the code-projects site for updates, and if there is none, treat the software as unsupported.
Is this being exploited in the wild?
The record is not on the CISA Known Exploited Vulnerabilities list. It does say that exploit details are public, so the risk of probing is real.
Sources
Last reviewed: 19 October 2026.
