CVE-2026-13567: Reflected XSS in code-projects Online Music Site 1.0 Feedback Form

Technical summary

CVE-2026-13567 is a reflected XSS vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). The vulnerable component is the POST request handler in /Frontend/Feedback.php, which fails to sanitize user-supplied input in the fname, femail, faddress, and fmessage parameters before echoing them back to the client. The attack requires no authentication (PR:N) and minimal complexity (AC:L), but does require user interaction (UI:R) to click a malicious link. The CVSS 3.1 score of 4.3 reflects low severity impact—integrity is compromised (I:L) with no confidentiality or availability impact.

Business impact

Organizations running code-projects Online Music Site 1.0 face reputational and operational risk. An attacker can craft a malicious feedback URL to harvest visitor credentials, inject fake reviews or spam, or redirect users to phishing pages. Customer trust erodes if feedback data is visibly compromised or if the site becomes a vector for further attacks. While the CVSS score is moderate, the presence of public exploits and reliance on user interaction (typical for feedback forms with high traffic) amplifies real-world exposure.

Affected systems

This vulnerability affects code-projects Online Music Site version 1.0 specifically. The attack vector is network-based and requires no special privileges, meaning any internet-connected instance is at risk. Environments where users frequently interact with feedback forms—or where feedback URLs are shared via email or social media—face heightened exposure.

Exploitability

Exploitability is elevated due to public availability of proof-of-concept code and the simplicity of the attack. An attacker constructs a URL with XSS payload in one of the four vulnerable parameters and tricks a user into clicking it (via phishing, social engineering, or a compromised referrer). The payload executes in the victim's session context, with no additional technical barriers. User interaction is the primary mitigation at the network level.

Remediation

Immediate action is required to patch or upgrade code-projects Online Music Site beyond version 1.0. If an update is not available, implement web application firewall (WAF) rules to block requests containing script tags or event handlers in the feedback parameters. Apply output encoding to all user input before rendering on the page. As a temporary measure, disable the feedback form or restrict it to authenticated users only. Test any changes in a non-production environment first.

Patch guidance

Verify the latest version of code-projects Online Music Site against the vendor's official advisory to confirm XSS remediation. If running version 1.0, upgrade to the next available release. Validate that sanitization functions (e.g., htmlspecialchars() or equivalent) are applied to fname, femail, faddress, and fmessage parameters on output. If the vendor has released a specific security patch version, apply it and test form functionality to ensure no regression.

Detection guidance

Monitor web server logs for POST requests to /Frontend/Feedback.php containing suspicious payloads such as <script>, javascript:, onerror=, or onload=. Search request parameters (fname, femail, faddress, fmessage) for encoded or obfuscated script tags (e.g., %3Cscript%3E). Implement browser-side detection using Content Security Policy (CSP) headers to prevent inline script execution. Log and alert on any reflected content that was not sanitized. Review error logs for any failed input validation attempts.

Why prioritize this

Although the CVSS score is 4.3 (MEDIUM), this vulnerability merits prompt attention due to public exploit availability and low attack complexity. Feedback forms are high-interaction components, and the combination of easy exploitation and real-world exposure justifies moving this into the near-term patching queue. Organizations with public-facing Online Music Site instances should prioritize this within 2–4 weeks.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a low-severity impact (integrity only, no confidentiality or availability loss) coupled with a low-complexity, unauthenticated attack. The user interaction requirement (UI:R) prevents a higher score, since reflected XSS typically depends on social engineering. However, in a real-world context with active public exploits and a popular feedback mechanism, the actual risk is higher than the numeric score suggests. Organizations should not use CVSS score alone to deprioritize this vulnerability.

Frequently asked questions