CVE-2025-11289
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was found in CicadasCMS (up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab) in the Save function of TemplateFileServiceImpl.java, within the template management component. The cross-site scripting (XSS) flaw allows remote exploitation. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker can remotely inject malicious JavaScript that executes in the victim's browser, potentially leading to session or data theft. Organizations using CicadasCMS are at risk of XSS attacks.
Recommendation
Update CicadasCMS to the latest version that fixes this vulnerability. If updating is not possible, implement input and output filtering in the template management component.
Other vulnerabilities in CicadasCMS
See all- CVE-2026-10529Low
Vulnerability in westboy CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab. An unknown function in ScheduleJobController.java in the task scheduling module is vulnerable to XSS. The attack can be performed remotely.
- CVE-2026-10153Medium
In westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, the Search function in org/springframework/cache/support/AbstractCacheManager.java is vulnerable to cross-site scripting (XSS) via the s argument. Remote exploitation is possible and the exploit is public.
- CVE-2025-11069Low
A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.
- CVE-2025-11068Low
A vulnerability in westboy CicadasCMS 1.0 affects an unknown functionality in the /system/cms/category/save file. Manipulation of the categoryName argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Management Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS