CVE-2025-15374: EyouCMS Ask Module Ask.php cross site scripting
A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component Ask Module. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15374?
CVE-2025-15374 is considered a high severity vulnerability due to its potential to allow remote cross-site scripting attacks.
How do I fix CVE-2025-15374?
To mitigate CVE-2025-15374, upgrade EyouCMS to version 1.7.8 or later where this vulnerability is patched.
What components are affected by CVE-2025-15374?
CVE-2025-15374 affects the Ask Module, specifically the application/home/model/Ask.php file in EyouCMS versions up to 1.7.7.
Can CVE-2025-15374 be exploited remotely?
Yes, CVE-2025-15374 can be exploited remotely by manipulating the argument content in the affected module.
What type of attack does CVE-2025-15374 facilitate?
CVE-2025-15374 facilitates cross-site scripting (XSS) attacks that can compromise the security of the affected web application.