PT-2025-53662 · Sohu · Sohutv Cachecloud

Zast.Ai · Published 2025-12-28 · Updated 2026-01-07 · CVE-2025-15146

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SohuTV CacheCloud versions up to 3.2.0

Description A security issue exists in SohuTV CacheCloud. Manipulation of the doUserList function within the file src/main/java/com/sohu/cache/web/controller/UserManageController.java can lead to cross site scripting. This attack can be initiated remotely. The exploit is publicly available. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 3.2.0 should be updated. As a temporary workaround, consider restricting access to the doUserList function until a patch is available.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-15146

Affected Products

Sohutv Cachecloud

References · 11

• 🔥 https://github.com/sohutv/cachecloud/issues/366#issue-3733542570 · Exploit
• 🔥 https://github.com/sohutv/cachecloud/issues/366 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15146 · Security Note
• https://t.me/cveNotify/147934 · Telegram Post
• https://t.me/CVEtracker/40783 · Telegram Post
• https://t.me/cveNotify/146986 · Telegram Post
• https://vuldb.com/?id.338524 · Note
• https://vuldb.com/?ctiid.338524 · Note
• https://vuldb.com/?submit.716302 · Note
• https://twitter.com/CVEnew/status/2005335666201116792 · Twitter Post