Description
PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHPSUGAR | PHP Melody | 3.0 | — |
References
- Vulnerability Lab Advisory exploit
- Vulnerability Lab Advisory patch
- Product Homepage product
- VulnCheck Advisory: PHP Melody 3.0 Non-Persistent Cross-Site Scripting via Multiple Parameters third-party-advisory