CVE-2026-2211 is a SQL injection flaw in code-projects Online Music Site 1.0, scored 7.3 (High) in the CVE record. The weak spot is the ID parameter of the delete category page. The record lists no fixed version, so take the app off public networks, and if you maintain the code, replace string built queries with prepared statements.
What's affected
- Product: code-projects Online Music Site
- Affected version: 1.0
- Location:
/Administrator/PHP/AdminDeleteCategory.php(Admin delete category page) - Input at issue: the ID parameter of the delete category page
- Fixed version: none listed in the record
The record says the exploit has been disclosed publicly. It does not say the flaw is being used in attacks, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Check the project page or vendor site for a newer release.
How to check if you're exposed
The first question is whether this app is running anywhere you own. Projects like this are easy to deploy and easy to forget.
find /var/www /srv /opt /home -path "*/Administrator/PHP/AdminDeleteCategory.php" 2>/dev/null
If the file turns up, confirm the app is version 1.0 and whether the web server answers from outside your network. Then open that file and read how it builds its database query. If the request value is joined into the SQL text instead of passed as a bound parameter, the weakness is present.
What to do now
- Find every copy of the app, including staging and backup hosts.
- If it faces the internet, take it offline or put it behind a VPN or an allow list of known addresses now.
- Check the project page for a patched release. If none exists, plan to retire the app or fix the query yourself.
- If you keep it, change the affected query to use prepared statements with bound parameters, and give the database account only the rights the app needs.
- Review web server and database logs for odd requests to the affected page.
Why it matters
The class here is CWE-89, a form of CWE-74. The page treats request input as trusted and places it inside a query. The database cannot tell the developer's intent from the attacker's text, so the fix belongs in code: send the values separately from the SQL.
The practical risk depends on what sits in the database and how exposed the page is. A demo app holding test rows is a small problem. The same app on a shared host with real user records is not.
Quick check
Is there a patch for this?
The record lists no fixed version. Check the project page or vendor site, and until you find one, limit network access to the app.
Does a dependency scan find this?
No. The flaw is in the app's own PHP code, not in a library. Code review or a static code scan finds this kind of issue, and the dependency scan covers the packages around it.
Sources
- CVE record for CVE-2026-2211 on Gold
- [https://github.com/yuji0903/silver-guide/issues/6](Researcher issue report (GitHub))
Last reviewed: 19 October 2026.
