{"id":"CVE-2021-47915","state":"PUBLISHED","title":"PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter","description":"PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.","publishedAt":"2026-02-01T12:15:49.150Z","updatedAt":"2026-03-05T01:29:17.029Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["PHPSUGAR PHP Melody"],"affected":[{"vendor":"PHPSUGAR","product":"PHP Melody","defaultStatus":"unaffected","versions":[{"version":"3.0","status":"affected"}]}],"references":["https://www.vulnerability-lab.com/get_content.php?id=2295","https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/","https://www.phpsugar.com/phpmelody.html","https://www.vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-edit-video-parameter"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47915.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47915","state":"PUBLISHED","datePublished":"2026-02-01T12:15:49.150Z","dateUpdated":"2026-03-05T01:29:17.029Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-01T11:24:18.714Z"},"containers":{"cna":{"title":"PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter","descriptions":[{"lang":"en","value":"PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system."}],"affected":[{"vendor":"PHPSUGAR","product":"PHP Melody","defaultStatus":"unaffected","versions":[{"version":"3.0","status":"affected"}]}],"references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2295","name":"Vulnerability Lab Advisory","tags":["exploit"]},{"url":"https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/","name":"Vulnerability Lab Advisory","tags":["patch"]},{"url":"https://www.phpsugar.com/phpmelody.html","name":"Product Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-edit-video-parameter","name":"VulnCheck Advisory: PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:29:17.029Z"},"datePublic":"2021-10-19T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phpsugar:php_melody:2.7.2:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Vulnerability-Lab [Research Team]","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-02T18:05:15.720979Z","id":"CVE-2021-47915","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-02T18:05:23.453Z"}}]}}}