CVE-2021-47914
PHP Melody 3.0 Persistent XSS Vulnerability via Edit Video Parameter
CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.
| CWE | CWE-79 |
| Vendor | phpsugar |
| Product | php melody |
| Published | Feb 1, 2026 |
| Last Updated | Mar 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for phpsugar php melody
Be the first to know when new medium vulnerabilities affecting phpsugar php melody are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
PHPSUGAR / PHP Melody
3.0
References
vulnerability-lab.com: https://www.vulnerability-lab.com/get_content.php?id=2292 phpsugar.com: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ phpsugar.com: https://www.phpsugar.com/phpmelody.html vulncheck.com: https://www.vulncheck.com/advisories/php-melody-persistent-xss-vulnerability-via-edit-video-parameter
Credits
Vulnerability-Lab [Research Team]