Unrated severityNVD Advisory· Published Feb 1, 2026· Updated Mar 5, 2026
PHP Melody 3.0 Non-Persistent Cross-Site Scripting via Multiple Parameters
CVE-2021-47912
Description
PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions.
Affected products
1- PHPSUGAR/PHP Melodyv5Range: 3.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/mitrepatch
- www.vulnerability-lab.com/get_content.phpmitreexploit
- www.vulncheck.com/advisories/php-melody-non-persistent-cross-site-scripting-via-multiple-parametersmitrethird-party-advisory
- www.phpsugar.com/phpmelody.htmlmitreproduct
News mentions
0No linked articles in our index yet.