CVE-2026-0851: Fabian Online Music Site

What is CVE-2026-0851?

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS<1% · P24

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD published2026-01-12

NVD last modified2026-06-17

Timeline

2026-01-12Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

Fabian Online Music Site

Remediation Steps

Document all PTC Windchill instances and their versions across enterprise
Apply PTC security patches addressing remote code execution flaw
Restrict Windchill access to authorized users via VPN or network segmentation
Implement input validation and WAF rules for Windchill web interfaces
Enable enhanced logging and monitoring for unusual Windchill process execution

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 5 of March 2026 (March 30 – April 5)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.