CVE-2025-11069
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.
Risk Assessment
The XSS vulnerability could allow an attacker to execute malicious scripts in an administrator's browser, potentially leading to session hijacking or content modification.
Recommendation
Update CicadasCMS to the latest version and apply proper input filtering to prevent XSS.
Other vulnerabilities in CicadasCMS
See all- CVE-2026-10529Low
Vulnerability in westboy CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab. An unknown function in ScheduleJobController.java in the task scheduling module is vulnerable to XSS. The attack can be performed remotely.
- CVE-2026-10153Medium
In westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, the Search function in org/springframework/cache/support/AbstractCacheManager.java is vulnerable to cross-site scripting (XSS) via the s argument. Remote exploitation is possible and the exploit is public.
Original NVD description (English source)
A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS