PHPSUGAR

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

PHPSUGAR records in CISA KEV

No PHPSUGAR vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Php Melody 9 records MEDIUM Ultimate Regnow Affiliate 1 record LOW

Records

9 records in Php Melody · all components

TI-2021-22528 CVE-2021-47914 · GHSA-34qg-fch7-c5r6

PHP Melody 3.0 Persistent XSS Vulnerability via Edit Video Parameter

MEDIUM 56

PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00345 Published 2026-02-01 No fix listed CWE-79

TI-2021-22527 CVE-2021-47913 · GHSA-qg67-f99g-xghr

PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor

MEDIUM 56

PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00265 Published 2026-02-01 No fix listed CWE-79

TI-2021-22526 CVE-2021-47912 · GHSA-f7c7-p5x7-c759

PHP Melody 3.0 Non-Persistent Cross-Site Scripting via Multiple Parameters

MEDIUM 56

PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00265 Published 2026-02-01 No fix listed CWE-79

TI-2017-11057 CVE-2017-15081 · GHSA-5256-pxr5-xx72

In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

MEDIUM 47

In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02407 Published 2017-10-24 No fix listed CWE-89

TI-2021-22529 CVE-2021-47915 · GHSA-wwx6-9732-2f48

PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter

MEDIUM 46

PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00585 Published 2026-02-01 No fix listed CWE-89

TI-2018-03769 CVE-2018-5211 · GHSA-j744-q4j3-97jc

PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.

MEDIUM 46

PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01929 Published 2018-01-09 No fix listed CWE-89

TI-2017-11380 CVE-2017-15579 · GHSA-w8gh-wq86-m296

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie…

MEDIUM 45

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01485 Published 2017-10-18 No fix listed CWE-89

TI-2017-11379 CVE-2017-15578 · GHSA-cx92-x4f6-25pj

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.

MEDIUM 41

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01337 Published 2017-10-18 No fix listed CWE-89

TI-2017-11439 CVE-2017-15648 · GHSA-4pq6-2v68-75x5

In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.

LOW 28

In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00661 Published 2017-10-19 No fix listed CWE-79

Open these records in search →

Critical	3
High	3
Medium	4
Low	0
No CVSS	0