CVE-2015-8310

Cherry Music Cross-site Scripting (XSS) vulnerability

5.4 MediumFix available

CVE-2015-8310 is a medium vulnerability (CVSS 5.4) in Fomori Cherrymusic, published March 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in cherrymusic 0.36.0.

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.85%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2015-8310
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-8310
Updated: 2026-11-02

EUVDEUVD-2017-0017 No score

Record: EUVD-2017-0017
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4wcc-jv3p-prqw 5.1

Cherry Music Cross-site Scripting (XSS) vulnerability

Record: GHSA-4wcc-jv3p-prqw
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-4wcc-jv3p-prqw 5.1

Cherry Music Cross-site Scripting (XSS) vulnerability

Record: GHSA-4wcc-jv3p-prqw
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2017-100 No score

Record: PYSEC-2017-100
Updated: 2026-11-02

Affected products

fomori cherrymusic

Affected packages

Affected packages
Package	Affected	Fixed
`cherrymusic` PyPI	before 0.36.0	0.36.0
`cherrymusic` PyPI	before 0.36.0, plus listed versions 0.30.00.31.00.31.10.31.20.32.0 Show 5 moreShow less 0.33.00.34.00.34.10.35.10.35.2	0.36.0
`cherrymusic` PyPI	before 0.36.0, plus listed versions 0.30.00.31.00.31.10.31.20.32.0 Show 19 moreShow less 0.33.00.34.00.34.10.35.10.35.20.35.00.27.20.27.10.27.00.26.00.25.20.25.10.25.00.24.00.23.00.22.00.21.00.20.00.11.0	0.36.0

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV