Is there a public PoC exploit available for CVE-2025-15374?

Yes, a public proof-of-concept exploit is available for CVE-2025-15374. Prioritise patching immediately. EPSS: 0.0%.

EyouCMS CVE-2025-15374

Q: What is the CVSS score of CVE-2025-15374?

CVE-2025-15374 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 cna@vuldb.com

XSS PHP Eyoucms

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Low-privilege account required to submit Ask content; victim must view it (UI:R); scope changes to victim browser context enabling cookie access (S:C, C:L, I:L); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:35 vuln.today

CVE Published

Dec 31, 2025 - 05:16 cve.org

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component Ask Module. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".

AnalysisAI

Cross-site scripting in EyouCMS up to version 1.7.7 allows a low-privileged remote attacker to inject malicious script content via the content argument in the Ask Module (application/home/model/Ask.php), which executes in the browser of any user who subsequently views the injected submission. A public proof-of-concept is available, though EPSS at 0.04% (11th percentile) and absence from CISA KEV indicate minimal observed exploitation despite the public PoC. The vendor has acknowledged the flaw and committed to releasing v1.7.8 as the fix, though that release has not been independently confirmed as available at time of analysis.

Technical ContextAI

EyouCMS is a PHP-based content management system. The vulnerability resides in the Ask Module model file application/home/model/Ask.php, which processes user-supplied content input without adequate output encoding or sanitization before rendering it in the browser - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw. The Ask Module appears to implement a Q&A or customer inquiry feature where submitted content is stored and later displayed to administrators or other users, making this likely a stored XSS variant rather than reflected. The CPE string cpe:2.3:a:eyoucms:eyoucms:*:*:*:*:*:*:*:* with no version bound on the upper end confirms all versions through 1.7.7 are affected. The CVSS 4.0 vector's E:P (exploit Proof-of-concept) modifier corroborates the publicly referenced PoC.

RemediationAI

The primary remediation is to upgrade to EyouCMS v1.7.8 once the vendor publishes it; monitor the vendor's official release channel and the VulDB entry at https://vuldb.com/?id.339082 for confirmation of the release. As an interim compensating control, disable or restrict access to the Ask Module entirely for untrusted users - since PR:L is required, removing low-privilege users' ability to submit Ask Module content eliminates the attack surface with the trade-off of losing that feature's functionality. A WAF rule filtering common XSS patterns (script tags, event handlers, javascript: URIs) in the content POST parameter can provide an additional defense layer, though this may produce false positives on legitimate rich-text submissions and should be tuned carefully. Upstream fix availability is referenced by PR/commit via the PoC link; a formally tagged and distributed patched version has not been independently confirmed.