Vendors / PHPSUGAR Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 3
Exploited now PHPSUGAR records in CISA KEV No PHPSUGAR vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 56
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00345 · Published 2026-02-01 · No fix listed CWE-79
Priority MEDIUM 56
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00265 · Published 2026-02-01 · No fix listed CWE-79
Priority MEDIUM 56
PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00265 · Published 2026-02-01 · No fix listed CWE-79
Priority MEDIUM 47
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02407 · Published 2017-10-24 · No fix listed CWE-89
Priority MEDIUM 46
PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands.
CVSS 4.0 HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.00585 · Published 2026-02-01 · No fix listed CWE-89
Priority MEDIUM 46
PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01929 · Published 2018-01-09 · No fix listed CWE-89
Priority MEDIUM 45
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01485 · Published 2017-10-18 · No fix listed CWE-89
Priority MEDIUM 41
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
CVSS 3.0 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01337 · Published 2017-10-18 · No fix listed CWE-89
Priority LOW 35
SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS 2.0 HIGH 7.5· Network · No auth · Interaction — · EPSS 0.00923 · Published 2009-08-20 · No fix listed CWE-89
Priority LOW 28
In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00661 · Published 2017-10-19 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 3 4 0 0
THREATIST.IORead the docs