Vulnerability · Published Oct 5, 2025 · Assigned by VulDB

CVE-2025-11289westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in CicadasCMS from westboy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Management Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
westboy	CicadasCMS	2431154dac8d0735e04f1fd2a3c3556668fc8dab

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-327170 | westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting vdb-entry, technical-description
VDB-327170 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #659789 | https://gitee.com/westboy/CicadasCMS/branches CicadasCMS v1.0 Cross Site Scripting third-party-advisory
Submit #709804 | CicadasCMS 1.0 Code Injection (Duplicate) third-party-advisory
https://github.com/devastatingglamour/CVE/blob/main/CicadasCMS-XSS4.md exploit