CVE-2025-15219
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In SohuTV CacheCloud up to 3.2.0, the doMachineList/doPodList functions in MachineManageController.java are vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
Risk Assessment
The risk includes the possibility of remote script injection, which could lead to user session hijacking, data theft, or unauthorized actions within the application.
Recommendation
It is recommended to apply patches or upgrade to a newer version, and to implement output validation and encoding in the doMachineList/doPodList functions.
Other vulnerabilities in SohuTV CacheCloud
See all- CVE-2025-15204Low
A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. The function doQuartzList in QuartzManageController.java is affected. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.
- CVE-2025-15203Low
A vulnerability was found in SohuTV CacheCloud up to 3.2.0. The function index in ResourceController.java is affected. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed but has not responded.
- CVE-2025-15202Low
In SohuTV CacheCloud up to 3.2.0, the taskQueueList function in TaskController.java is vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
Original NVD description (English source)
A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doMachineList/doPodList of the file src/main/java/com/sohu/cache/web/controller/MachineManageController.java. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS