Phpsugar
Products
2- 8 CVEs
- 1 CVE
Recent CVEs
9| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-15081 | Cri | 0.67 | 9.8 | 0.02 | Oct 24, 2017 | In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php. | ||
| CVE-2017-15579 | Cri | 0.67 | 9.8 | 0.01 | Oct 18, 2017 | In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php. | ||
| CVE-2017-15578 | Hig | 0.60 | 8.8 | 0.01 | Oct 18, 2017 | In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php. | ||
| CVE-2017-15648 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2017 | In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter. | ||
| CVE-2009-2895 | 0.03 | — | 0.01 | Aug 20, 2009 | SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter. | |||
| CVE-2021-47915 | 0.00 | — | 0.01 | Feb 1, 2026 | PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially… | |||
| CVE-2021-47914 | 0.00 | — | 0.00 | Feb 1, 2026 | PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading… | |||
| CVE-2021-47913 | 0.00 | — | 0.00 | Feb 1, 2026 | PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application… | |||
| CVE-2021-47912 | 0.00 | — | 0.00 | Feb 1, 2026 | PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions. |
- risk 0.67cvss 9.8epss 0.02
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
- risk 0.67cvss 9.8epss 0.01
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.
- risk 0.60cvss 8.8epss 0.01
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
- risk 0.40cvss 6.1epss 0.01
In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.
- CVE-2009-2895Aug 20, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
- CVE-2021-47915Feb 1, 2026risk 0.00cvss —epss 0.01
PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially…
- CVE-2021-47914Feb 1, 2026risk 0.00cvss —epss 0.00
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading…
- CVE-2021-47913Feb 1, 2026risk 0.00cvss —epss 0.00
PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application…
- CVE-2021-47912Feb 1, 2026risk 0.00cvss —epss 0.00
PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions.