CVE-2025-11069
westboy CicadasCMS Add Department save cross site scripting
- State
- Published
- Severity
- 4.8 Medium
- Published
- Sep 27, 2025
- Updated
- Sep 29, 2025
- Reserved
- Sep 26, 2025
Description
A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.4 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 2.4 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CicadasCMSwestboy |
|
References
- VDB-326108 | westboy CicadasCMS Add Department save cross site scriptingvdb-entrytechnical-description
- VDB-326108 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #659653 | https://gitee.com/westboy/CicadasCMS/branches CicadasCMS v1.0 Cross Site Scriptingthird-party-advisory
- https://github.com/devastatingglamour/CVE/blob/main/CicadasCMS-XSS3.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.