CVE-2021-47913: Phpsugar PHP Melody

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation.

Affected products

• Phpsugar PHP Melody: version 3.0 only

Published 2026-02-01. Last modified 2026-06-17.