Is there a public PoC exploit available for CVE-2025-15171?

Yes, a public proof-of-concept exploit is available for CVE-2025-15171. Prioritise patching immediately. EPSS: 0.0%.

SohuTV CacheCloud CVE-2025-15171

Q: What is the CVSS score of CVE-2025-15171?

CVE-2025-15171 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-29 cna@vuldb.com

XSS Java Cachecloud Sohu

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:44 vuln.today

DescriptionCVE.org

A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/ServerController.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated remote attackers to inject malicious scripts via the index function in ServerController.java, requiring user interaction to execute. The exploit is publicly available on GitHub, though the project maintainers have not responded to early disclosure reports. With an EPSS score of 0.03% and CVSS 2.0 severity, real-world exploitation risk is minimal despite public POC availability.

Technical ContextAI

SohuTV CacheCloud is a distributed caching solution built in Java. The vulnerability exists in the ServerController class, specifically the index function (src/main/java/com/sohu/cache/web/controller/ServerController.java), which fails to properly sanitize or encode user-supplied input before rendering it in HTTP responses. This is a classic reflected XSS flaw (CWE-79) where attacker-controlled data from request parameters is echoed back to the client without HTML encoding or output validation, allowing JavaScript execution in the victim's browser context.

RemediationAI

No vendor-released patch has been identified at time of analysis; the SohuTV project has not responded to the early disclosure report filed via GitHub issue. Immediate workarounds include: (1) upgrade CacheCloud to a version beyond 3.2.0 if available (verify with upstream project), (2) apply input validation and HTML encoding to the ServerController.index function by reviewing the code at https://github.com/sohutv/cachecloud and implementing parameterized output encoding or a Web Application Firewall rule that strips script tags from responses, (3) restrict network access to CacheCloud administrative interfaces using firewall rules or network segmentation to limit exposure to authenticated users only, and (4) disable browser script execution for CacheCloud URLs via Content Security Policy headers if feasible. Given the low EPSS and lack of vendor response, patching should be scheduled during normal maintenance windows rather than treated as emergency. Monitor GitHub issue #367 for any upstream patch announcements.