What’s Vulnerable › Vulnerabilities

CVE-2021-47915: PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-01 · updated 2026-06-17
• Weakness: CWE-89

Description

PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.

Affected products

• PHPSUGAR PHP Melody: 3.0

References

• https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/
• https://www.phpsugar.com/phpmelody.html
• https://www.vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-edit-video-parameter
• https://www.vulnerability-lab.com/get_content.php?id=2295

Get alerted when CVE-2021-47915 or the next vulnerability affects your stack