CVE-2026-7238: code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload

Published Apr 28, 2026

Updated

A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulation of the argument txtimage causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Affected Software

1 affected component

Code-projects Online Music Site=1.0

Event History

Apr 28, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Jul 2, 58309

Event

via FIRST·03:47 PM

Frequently Asked Questions

What is the severity of CVE-2026-7238?

CVE-2026-7238 is classified as a high severity vulnerability due to the potential for remote code execution through unrestricted file uploads.

How do I fix CVE-2026-7238?

To fix CVE-2026-7238, ensure proper validation and sanitization of file uploads in the AdminUpdateAlbum.php script.

What systems are affected by CVE-2026-7238?

CVE-2026-7238 affects version 1.0 of the code-projects Online Music Site.

Can CVE-2026-7238 be exploited remotely?

Yes, CVE-2026-7238 can be exploited remotely, allowing an attacker to upload malicious files without restriction.

What part of the code is vulnerable in CVE-2026-7238?

The vulnerability in CVE-2026-7238 lies within the argument handling of the txtimage parameter in /Administrator/PHP/AdminUpdateAlbum.php.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.