CVE-2025-15204
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. The function doQuartzList in QuartzManageController.java is affected. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.
Risk Assessment
XSS attack can execute malicious scripts in the user's browser, potentially leading to session theft, account takeover, or other actions in the application context.
Recommendation
Restrict access to the application and monitor for exploitation attempts. Consider applying input filters or updating if available.
Other vulnerabilities in SohuTV CacheCloud
See all- CVE-2025-15221Low
A flaw was found in SohuTV CacheCloud up to version 3.2.0. It affects the index function in the file src/main/java/com/sohu/cache/web/controller/AppDataMigrateController.java. This manipulation causes cross-site scripting. Remote exploitation is possible. The exploit has been published and may be used. The project was informed but has not responded.
- CVE-2025-15220Medium
A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginController.java. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public. The project was informed but has not responded.
- CVE-2025-15219Low
In SohuTV CacheCloud up to 3.2.0, the doMachineList/doPodList functions in MachineManageController.java are vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
- CVE-2025-15203Low
A vulnerability was found in SohuTV CacheCloud up to 3.2.0. The function index in ResourceController.java is affected. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed but has not responded.
- CVE-2025-15202Low
In SohuTV CacheCloud up to 3.2.0, the taskQueueList function in TaskController.java is vulnerable to cross-site scripting (XSS). The attack can be performed remotely, and the exploit has been publicly disclosed. The project has not responded to the issue report.
- CVE-2025-15201Low
A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in the redirectNoPower function in WebResourceController.java. The attack can be executed remotely and the exploit has been published. The project has not responded.
- CVE-2025-15200Low
A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in functions getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex in AppClientDataShowController.java. The attack can be executed remotely and the exploit is public. The project has not responded.
- CVE-2025-15175Low
A vulnerability was detected in SohuTV CacheCloud up to 3.2.0 affecting the doAppList/appCommandAnalysis function in src/main/java/com/sohu/cache/web/controller/AppController.java. Manipulating input results in cross site scripting. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-15174Low
A security vulnerability was detected in SohuTV CacheCloud up to 3.2.0 affecting the doAppAuditList function in src/main/java/com/sohu/cache/web/controller/AppManageController.java. Such manipulation leads to cross site scripting. The attack may be performed remotely and the exploit has been publicly disclosed.
- CVE-2025-15173Low
A cross-site scripting vulnerability was found in SohuTV CacheCloud up to 3.2.0 in the advancedAnalysis function in InstanceController.java. The attack can be executed remotely and the exploit is publicly available. The project has not responded.
Original NVD description (English source)
A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/cache/web/controller/QuartzManageController.java. Executing manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS