{"id":"CVE-2021-47913","state":"PUBLISHED","title":"PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor","description":"PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.","publishedAt":"2026-02-01T12:15:48.331Z","updatedAt":"2026-03-05T01:29:15.469Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["PHPSUGAR PHP Melody"],"affected":[{"vendor":"PHPSUGAR","product":"PHP Melody","defaultStatus":"unaffected","versions":[{"version":"3.0","status":"affected"}]}],"references":["https://www.vulnerability-lab.com/get_content.php?id=2291","https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/","https://www.phpsugar.com/phpmelody.html","https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editor"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47913.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47913","state":"PUBLISHED","datePublished":"2026-02-01T12:15:48.331Z","dateUpdated":"2026-03-05T01:29:15.469Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-01T11:24:18.712Z"},"containers":{"cna":{"title":"PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor","descriptions":[{"lang":"en","value":"PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation."}],"affected":[{"vendor":"PHPSUGAR","product":"PHP Melody","defaultStatus":"unaffected","versions":[{"version":"3.0","status":"affected"}]}],"references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2291","name":"Vulnerability Lab Advisory","tags":["exploit"]},{"url":"https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/","name":"Vulnerability Lab Advisory","tags":["patch"]},{"url":"https://www.phpsugar.com/phpmelody.html","name":"Product Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editor","name":"VulnCheck Advisory: PHP Melody 3.0 Persistent Cross-Site Scripting via Video Editor","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:29:15.469Z"},"datePublic":"2021-10-20T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phpsugar:php_melody:2.7.2:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Vulnerability-Lab [Research Team]","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2291","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-03T16:35:39.691688Z","id":"CVE-2021-47913","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-03T16:41:31.586Z"}}]}}}