What’s Vulnerable › Vulnerabilities

CVE-2021-47914: PHP Melody 3.0 Persistent XSS Vulnerability via Edit Video Parameter

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-01 · updated 2026-06-17
• Weakness: CWE-79

Description

PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.

Affected products

• PHPSUGAR PHP Melody: 3.0

References

• https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/
• https://www.phpsugar.com/phpmelody.html
• https://www.vulncheck.com/advisories/php-melody-persistent-xss-vulnerability-via-edit-video-parameter
• https://www.vulnerability-lab.com/get_content.php?id=2292

Get alerted when CVE-2021-47914 or the next vulnerability affects your stack