PHPSUGAR PHP Melody 2.7.2
Approved changes feed: RSS · Atom
cpe:2.3:a:phpsugar:php_melody:2.7.2:*:*:*:*:*:*:*
part: a version: 2.7.2 update: *
| Vendor | Phpsugar (0980311a-240a-5d68-a766-320265c48370) |
|---|---|
| Product | Php Melody (01baf38b-2033-54f9-ba7c-4a7ae7871ead) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-47915 |
vulnerable | 2026-06-08 05:38:07.899065 |
PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter
HIGH (8.1)
PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.
Published: 2026-02-01T12:15:49.150Z
Updated: 2026-03-05T01:29:17.029Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47914 |
vulnerable | 2026-06-08 05:38:07.898427 |
PHP Melody 3.0 Persistent XSS Vulnerability via Edit Video Parameter
MEDIUM (6.4)
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.
Published: 2026-02-01T12:15:48.720Z
Updated: 2026-03-05T01:29:16.237Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47913 |
vulnerable | 2026-06-08 05:38:07.897859 |
PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor
MEDIUM (6.4)
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.
Published: 2026-02-01T12:15:48.331Z
Updated: 2026-03-05T01:29:15.469Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47912 |
vulnerable | 2026-06-08 05:38:07.892554 |
PHP Melody 3.0 Non-Persistent Cross-Site Scripting via Multiple Parameters
MEDIUM (6.4)
PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions.
Published: 2026-02-01T12:15:47.948Z
Updated: 2026-03-05T01:29:14.657Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.