CVE-2025-15374 MEDIUM

CVE-2025-15374: EyouCMS Ask Module Ask.php cross site scripting

Vendor N/A
Product EyouCMS
Weakness CWE-79 · XSS
Published December 31, 2025
Last update February 24, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component Ask Module. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor is "[a]cknowledging the existence of the vulnerability, we have completed the fix and will release a new version, v1.7.8".

Key dates

02Disclosure timeline

December 31, 2025 CVE published
February 24, 2026 Record updated