CVE-2021-47915
PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter
- State
- Published
- Severity
- 8.6 High
- Published
- Feb 1, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 1, 2026
Description
PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
PHP MelodyPHPSUGAR |
|
References
- Vulnerability Lab Advisoryexploit
- Vulnerability Lab Advisorypatch
- Product Homepageproduct
- VulnCheck Advisory: PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.