CVE-2021-47913
PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 1, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 1, 2026
Description
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
PHP MelodyPHPSUGAR |
|
References
- Vulnerability Lab Advisoryexploit
- Vulnerability Lab Advisorypatch
- Product Homepageproduct
- VulnCheck Advisory: PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editorthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.