Phpsugar Php Melody
9 CVEs affecting Phpsugar Php Melody. Latest disclosed: 2026-02-01. Critical: 3, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5211 | Critical | 9.8 | 2018-01-09 | PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist. |
CVE-2017-15081 | Critical | 9.8 | 2017-10-24 | In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php. |
CVE-2017-15579 | Critical | 9.8 | 2017-10-18 | In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php. |
CVE-2017-15578 | High | 8.8 | 2017-10-18 | In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php. |
CVE-2021-47915 | High | 8.1 | 2026-02-01 | PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL comma… |
CVE-2021-47914 | Medium | 6.4 | 2026-02-01 | PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to injec… |
CVE-2021-47913 | Medium | 6.4 | 2026-02-01 | PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers… |
CVE-2021-47912 | Medium | 6.4 | 2026-02-01 | PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject… |
CVE-2017-15648 | Medium | 6.1 | 2017-10-19 | In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter. |