CVE-2021-47913

PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor

CVSS 5.1 MEDIUMEPSS 0.2%CWE-79

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

01 feb 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Productos afectados

PHPSUGAR · PHP Melody

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/https://www.phpsugar.com/phpmelody.html https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editor https://www.vulnerability-lab.com/get_content.php?id=2291