CVE-2025-15202
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In SohuTV CacheCloud up to 3.2.0, the taskQueueList function in TaskController.java is vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
Risk Assessment
The risk includes the possibility of remote script injection, which could lead to user session hijacking, data theft, or unauthorized actions within the application.
Recommendation
It is recommended to apply patches or upgrade to a newer version, and to implement output validation and encoding in the taskQueueList function.
Other vulnerabilities in SohuTV CacheCloud
See all- CVE-2025-15219Low
In SohuTV CacheCloud up to 3.2.0, the doMachineList/doPodList functions in MachineManageController.java are vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
- CVE-2025-15204Low
A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. The function doQuartzList in QuartzManageController.java is affected. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.
- CVE-2025-15203Low
A vulnerability was found in SohuTV CacheCloud up to 3.2.0. The function index in ResourceController.java is affected. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed but has not responded.
Original NVD description (English source)
A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/cache/web/controller/TaskController.java. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS