P
HP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.
References
| Link | Resource |
|---|---|
| https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ | Vendor Advisory |
| https://www.phpsugar.com/phpmelody.html | Product |
| https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editor | Third Party Advisory |
| https://www.vulnerability-lab.com/get_content.php?id=2291 | Exploit Third Party Advisory |
| https://www.vulnerability-lab.com/get_content.php?id=2291 | Exploit Third Party Advisory |
Configurations
History
11 Feb 2026, 19:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Phpsugar php Melody
Phpsugar |
|
| References | () https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ - Vendor Advisory | |
| References | () https://www.phpsugar.com/phpmelody.html - Product | |
| References | () https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editor - Third Party Advisory | |
| References | () https://www.vulnerability-lab.com/get_content.php?id=2291 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:phpsugar:php_melody:3.0:*:*:*:*:*:*:* |
03 Feb 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.vulnerability-lab.com/get_content.php?id=2291 - |
01 Feb 2026, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-01 13:15
Updated : 2026-02-11 19:29
NVD link : CVE-2021-47913
Mitre link : CVE-2021-47913
CVE.ORG link : CVE-2021-47913
JSON object : View
Products Affected
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')