CVE-2026-37338

SourceCodester Simple Music Cloud Community System version 1.0 contains a SQL Injection vulnerability in the /music/view_user.php file that could allow unauthenticated attackers to execute arbitrary SQL queries against the application database. The vulnerability carries a CVSS score of 9.4 (Critical) due to its network-based attack vector, low complexity requirements, and lack of authentication prerequisites, resulting in high impacts to confidentiality and integrity. The exploit can be delivered remotely without user interaction, making it particularly dangerous from an attack surface perspective. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows minimal community engagement with an EPSS score of 0.00039, suggesting limited active exploitation in the wild at present. However, the critical severity rating and straightforward attack requirements warrant immediate patching for any organizations running affected versions.