VulnerabilityAnalyzed
CVE-2021-47913
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts.
MEDIUM 5.1EPSS 0.23%
Does this matter?
Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.
Description
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.
- CVSS 4.0
- 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.23% probability · 13th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- phpsugar/php melody
- Source
- disclosure@vulncheck.com
References
- https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/Vendor Advisory
- https://www.phpsugar.com/phpmelody.htmlProduct
- https://www.vulncheck.com/advisories/php-melody-persistent-cross-site-scripting-via-video-editorThird Party Advisory
- https://www.vulnerability-lab.com/get_content.php?id=2291Exploit, Third Party Advisory
- https://www.vulnerability-lab.com/get_content.php?id=2291Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.