CVE-2015-8310

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.fomori.org/cherrymusic/Changes.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/97148
https://github.com/devsnd/cherrymusic/commit/62dec34a1ea0741400dd6b6c660d303dcd651e86Patch, Third Party Advisory
https://github.com/devsnd/cherrymusic/issues/598Third Party Advisory
http://www.fomori.org/cherrymusic/Changes.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/97148
https://github.com/devsnd/cherrymusic/commit/62dec34a1ea0741400dd6b6c660d303dcd651e86Patch, Third Party Advisory
https://github.com/devsnd/cherrymusic/issues/598Third Party Advisory

Timeline

Published: Mar 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-83127.8Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system CVE-2015-83135.9GnuTLS incorrectly validates the first byte of padding in CBC modes CVE-2015-83147.5The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persis CVE-2015-83157.5The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "re CVE-2015-83165.9Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attacke CVE-2015-83175.0The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (CVE-2015-83187.8Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL CVE-2015-83197.8Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL CVE-2015-83205.0Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct CVE-2015-83228.8NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.CVE-2015-83244.6The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allow CVE-2015-83257.8The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read