Cherrymusic

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2015-8310 PyPI MEDIUM PATCH This Month

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

XSS Cherrymusic

NVD GitHub

CVSS 3.0

5.4

EPSS

0.2%

CVE-2015-8309 PyPI MEDIUM POC PATCH This Month

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download.". Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Path Traversal Cherrymusic

NVD GitHub Exploit-DB

CVSS 3.0

4.3

EPSS

6.6%

CVE-2015-8310 PyPI

EPSS 0% CVSS 5.4

MEDIUM PATCH This Month

XSS Cherrymusic

NVD GitHub

CVE-2015-8309 PyPI

EPSS 7% CVSS 4.3

MEDIUM POC PATCH This Month

Path Traversal Cherrymusic

NVD GitHub Exploit-DB