CVE-2021-47915

PHP Melody 3.0 SQL Injection Vulnerability via Edit Video Parameter

PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.

Affected

PHPSUGAR · PHP Melody

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULNCHECK

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.59% chance of exploitation in the next 30 days, 47th percentile

Published

2026-02-01

Updated

2026-03-05

Proof-of-concept exploits (1)

• https://www.vulnerability-lab.com/get_content.php?id=2295

Security advisories

• https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix
• https://www.vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-edit-vide…
• https://www.phpsugar.com/phpmelody.html

References

• CVE Record
• NVD entry