PT-2026-5560 · Unknown · Php Melody

Published 2026-02-01 · Updated 2026-02-05 · CVE-2021-47915

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP Melody version 3.0

Description PHP Melody version 3.0 has a remote SQL injection issue in the video edit module. Authenticated attackers can inject malicious SQL commands through the unvalidated vid parameter. Successful exploitation allows attackers to execute arbitrary database queries, potentially compromising the web application and its database management system.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the vid parameter before using it in database queries.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47915

Affected Products

Php Melody

References · 10

• 🔥 https://vulnerability-lab.com/get_content.php?id=2295 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47915 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47915 · Security Note
• https://twitter.com/CVEnew/status/2017954082045165916 · Twitter Post
• https://t.me/CVEtracker/43411 · Telegram Post
• https://vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-edit-video-parameter · Note
• https://twitter.com/cracbot/status/2019365431191171167 · Twitter Post
• https://t.me/cveNotify/150503 · Telegram Post
• https://phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix · Patch, Vendor Advisory
• https://phpsugar.com/phpmelody.html · Note