CVE-2026-37339
Published: 16 April 2026
Summary
CVE-2026-37339 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-37339, published on 2026-04-16, is a critical SQL injection vulnerability (CWE-89) in SourceCodester Simple Music Cloud Community System version 1.0. The flaw resides in the file /music/view_genre.php, where user-supplied input is not properly sanitized, allowing malicious SQL payloads to be injected into backend database queries. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a high-severity issue due to its ease of exploitation and severe potential impacts.
Remote attackers require no authentication or privileges and can exploit the vulnerability over the network with low complexity and no user interaction. Successful injection enables arbitrary SQL command execution, potentially allowing attackers to extract sensitive data such as user credentials or music metadata, modify database contents, delete records, or cause denial of service by corrupting the database.
Mitigation details and a proof-of-concept are documented in the reference advisory at https://github.com/mt-0505/cve-report/blob/main/sourcecodester/simple-music-cloud-community-system/SQL-3.md. Security practitioners should review this for reproduction steps and apply input validation, prepared statements, or upgrade to a patched version if available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23253
Vulnerability details
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote SQL injection vulnerability in a public-facing web application (PHP endpoint with no authentication required), directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of user-supplied inputs like those in /music/view_genre.php to prevent SQL injection by ensuring malicious payloads are rejected or sanitized before reaching database queries.
SI-9 enforces restrictions on information inputs to block SQL injection payloads in the unauthenticated view_genre.php endpoint by limiting input types, lengths, or characters.
SI-2 mandates timely identification and remediation of flaws like the SQL injection in /music/view_genre.php through patching or code fixes such as prepared statements.