Phpsugar

10 CVEs across 3 Phpsugar products. Browse Phpsugar vulnerabilities, severities, and proof-of-concept exploits.

Phpsugar products with known CVEs

ProductCVEs
Php Melody9
Php Melody4
Ultimate Regnow Affiliate1
Phpsugar CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2021-47915High8.12026-02-01PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL comma…
CVE-2021-47914Medium6.42026-02-01PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to injec…
CVE-2021-47913Medium6.42026-02-01PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers…
CVE-2021-47912Medium6.42026-02-01PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject…
CVE-2018-5211Critical9.82018-01-09PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
CVE-2017-15081Critical9.82017-10-24In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
CVE-2017-15648Medium6.12017-10-19In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.
CVE-2017-15579Critical9.82017-10-18In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.
CVE-2017-15578High8.82017-10-18In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
CVE-2009-28952009-08-20SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.