PT-2026-5559 · Unknown · Php Melody

Published 2026-02-01 · Updated 2026-02-01 · CVE-2021-47914

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Melody version 3.0

Description PHP Melody version 3.0 has a persistent cross-site scripting issue in the edit-video.php file’s submitted parameter. This allows attackers to inject malicious script code. Successful exploitation could lead to the execution of arbitrary JavaScript, potentially resulting in session hijacking, persistent phishing, and manipulation of application modules.

Recommendations Update PHP Melody to a newer version that addresses this vulnerability. As a temporary workaround, sanitize all input to the submitted parameter in the edit-video.php file.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47914

Affected Products

Php Melody

References · 9

• 🔥 https://vulnerability-lab.com/get_content.php?id=2292 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47914 · Security Note
• https://t.me/cveNotify/150502 · Telegram Post
• https://t.me/CVEtracker/43410 · Telegram Post
• https://twitter.com/CVEnew/status/2017954082959540725 · Twitter Post
• https://phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix · Patch, Vendor Advisory
• https://phpsugar.com/phpmelody.html · Note
• https://vulncheck.com/advisories/php-melody-persistent-xss-vulnerability-via-edit-video-parameter · Note