CVE-2026-10153
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, the Search function in org/springframework/cache/support/AbstractCacheManager.java is vulnerable to cross-site scripting (XSS) via the s argument. Remote exploitation is possible and the exploit is public.
Risk Assessment
XSS attack can execute malicious scripts in the victim's browser, leading to session theft or data leakage.
Recommendation
Update to the latest rolling release version or implement input validation as a temporary workaround.
Other vulnerabilities in CicadasCMS
See all- CVE-2026-108791Medium
A weakness in CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab affects the TemplateController.input function in the file /system/cms/template/input of the Template Management component. Manipulation of the filePath argument causes path traversal. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-108790Medium
A path traversal vulnerability has been discovered in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, affecting the TemplateController.save function in /system/cms/template/save (Backend Template Editor component). The attack can be performed remotely and a public exploit is already available. The vendor was contacted but did not respond.
- CVE-2026-10529Low
Vulnerability in westboy CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab. An unknown function in ScheduleJobController.java in the task scheduling module is vulnerable to XSS. The attack can be performed remotely.
- CVE-2025-11289Low
A vulnerability was found in CicadasCMS (up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab) in the Save function of TemplateFileServiceImpl.java, within the template management component. The cross-site scripting (XSS) flaw allows remote exploitation. The exploit has been publicly disclosed and may be used.
- CVE-2025-11069Low
A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.
- CVE-2025-11068Low
A vulnerability in westboy CicadasCMS 1.0 affects an unknown functionality in the /system/cms/category/save file. Manipulation of the categoryName argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Impacted is the function Search of the file org/springframework/cache/support/AbstractCacheManager.java. This manipulation of the argument s causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS