CVE-2017-15579

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.

• CWE-89

• http://www.phpsugar.com/blog/2017/10/php-melody-v2-7-3-maintenance-release/Release Notes, Vendor Advisory
• https://blogs.securiteam.com/index.php/archives/3464Exploit, Third Party Advisory
• http://www.phpsugar.com/blog/2017/10/php-melody-v2-7-3-maintenance-release/Release Notes, Vendor Advisory
• https://blogs.securiteam.com/index.php/archives/3464Exploit, Third Party Advisory

Published

Oct 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15573In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists b…
• CVE-2017-15574In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS i…
• CVE-2017-15575In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm l…
• CVE-2017-15576Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time …
• CVE-2017-15577Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the r…
• CVE-2017-15578In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists vi…
• CVE-2017-1558IBM Maximo Asset Management 7.5 and 7.6 could allow a remote…
• CVE-2017-15580osTicket 1.10.1 provides a functionality to upload 'html' fi…
• CVE-2017-15581In the "Diary with lock" (aka WriteDiary) application 4.72 f…
• CVE-2017-15582In net.MCrypt in the "Diary with lock" (aka WriteDiary) appl…
• CVE-2017-15583The embedded web server on ABB Fox515T 1.0 devices is vulner…
• CVE-2017-15587An integer overflow was discovered in pdf_read_new_xref_sect…