CVE-2015-8310: Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to...

Security readout for executives and security teams

Cherry Music before 0.36.0 lets a logged-in user place script or HTML in a playlist name. If another user views that unsafe content, browser-side actions could occur in the Cherry Music session context. The issue requires authentication, so urgency is highest where untrusted or shared accounts can create playlists. Exposure is likely limited to Cherry Music deployments older than 0.36.0 where authenticated users can create playlists. Risk increases if accounts are broadly shared, externally reachable, or issued to semi-trusted users. Treat as a targeted application hygiene issue, not a broad emergency. Prioritize remediation for exposed or shared Cherry Music services, especially where untrusted users have accounts. Mitigation focus: Upgrade Cherry Music to version 0.36.0 or later.; Check Cherry Music changelog and vendor project guidance.; Limit playlist creation to trusted users until upgraded..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.