PT-2025-53698 · Unknown · Sohutv Cachecloud

Zast.Ai · Published 2025-12-29 · Updated 2026-01-07 · CVE-2025-15175

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SohuTV CacheCloud versions prior to 3.2.1

Description A cross site scripting issue exists in SohuTV CacheCloud. The doAppList/appCommandAnalysis function within the AppController.java file is affected by this issue. Manipulation of input can lead to the execution of malicious scripts. The exploit is publicly available and may be used to initiate attacks remotely. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 3.2.1 should be updated. As a temporary workaround, consider restricting access to the doAppList/appCommandAnalysis function until a patch is available.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-15175

Affected Products

Sohutv Cachecloud

References · 11

• 🔥 https://github.com/sohutv/cachecloud/issues/381 · Exploit
• https://github.com/sohutv/cachecloud/issues/371 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15175 · Security Note
• https://vuldb.com/?id.338560 · Note
• https://vuldb.com/?submit.716309 · Note
• https://vuldb.com/?ctiid.338560 · Note
• https://t.me/cveNotify/147924 · Telegram Post
• https://t.me/CVEtracker/40817 · Telegram Post
• https://vuldb.com/?submit.716322 · Note
• https://t.me/cveNotify/147021 · Telegram Post