VulnerabilityAnalyzed
CVE-2021-47914
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code.
MEDIUM 5.1EPSS 0.32%
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules.
- CVSS 4.0
- 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.32% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- phpsugar/php melody
- Source
- disclosure@vulncheck.com
References
- https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/Vendor Advisory
- https://www.phpsugar.com/phpmelody.htmlProduct
- https://www.vulncheck.com/advisories/php-melody-persistent-xss-vulnerability-via-edit-video-parameterThird Party Advisory
- https://www.vulnerability-lab.com/get_content.php?id=2292Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.