CVE-2025-11069
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.
Risk Assessment
The XSS vulnerability could allow an attacker to execute malicious scripts in an administrator's browser, potentially leading to session hijacking or content modification.
Recommendation
Update CicadasCMS to the latest version and apply proper input filtering to prevent XSS.
Other vulnerabilities in CicadasCMS
See all- CVE-2026-108791Medium
A weakness in CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab affects the TemplateController.input function in the file /system/cms/template/input of the Template Management component. Manipulation of the filePath argument causes path traversal. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-108790Medium
A path traversal vulnerability has been discovered in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, affecting the TemplateController.save function in /system/cms/template/save (Backend Template Editor component). The attack can be performed remotely and a public exploit is already available. The vendor was contacted but did not respond.
- CVE-2026-10529Low
Vulnerability in westboy CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab. An unknown function in ScheduleJobController.java in the task scheduling module is vulnerable to XSS. The attack can be performed remotely.
- CVE-2026-10153Medium
In westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, the Search function in org/springframework/cache/support/AbstractCacheManager.java is vulnerable to cross-site scripting (XSS) via the s argument. Remote exploitation is possible and the exploit is public.
- CVE-2025-11289Low
A vulnerability was found in CicadasCMS (up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab) in the Save function of TemplateFileServiceImpl.java, within the template management component. The cross-site scripting (XSS) flaw allows remote exploitation. The exploit has been publicly disclosed and may be used.
- CVE-2025-11068Low
A vulnerability in westboy CicadasCMS 1.0 affects an unknown functionality in the /system/cms/category/save file. Manipulation of the categoryName argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS