CVE-2026-1443
published 2026-01-26CVE-2026-1443: A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.55%
45.6th percentile
A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code-projects | online_music_site | — | — |
| fabian | online_music_site | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
ghsa·2026-10-06·CVSS 5.0
CVE-2026-102414 [MEDIUM] CWE-400 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
### Summary
This is the same bug as Django had (CVE-2013-1443).
### Details
A long password can cause a DoS because it is not using cached HMAC, length limits, or pre-hashing passwords longer than the block size of the hash function as per HMAC spec. This line of code hashes the full password each iteration: https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/lib/sync.js#L60
Also see https://github.com/browserify/pbkdf2/issues/82
### PoC
The first key will take a lot longer to generate when not using the native code and uses code from `/lib/sync.js` (ie when this if statement is true):
https://github.com/browserify/pbkdf2/blob/1c3b1f526b052a29b3b42120c9821895772df7e8/index.js#L3
GHSA
GHSA-xxmq-8hjh-8rjg: A flaw has been found in code-projects Online Music Site 1
ghsa_unreviewed·2026-01-26
CVE-2026-1443 [MEDIUM] CWE-74 GHSA-xxmq-8hjh-8rjg: A flaw has been found in code-projects Online Music Site 1
A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-01-26
Published