PT-2025-39731 · Westboy · Cicadascms

Xmttz · Published 2025-09-27 · Updated 2025-09-27 · CVE-2025-11068

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS version 1.0

Description A cross site scripting issue exists in an unknown functionality of the file /system/cms/category/save. The manipulation of the categoryName argument can lead to the execution of remote scripts. The exploit for this issue has been publicly released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-11068

Affected Products

Cicadascms

References · 10

• 🔥 https://github.com/devastatingglamour/CVE/blob/main/CicadasCMS-XSS2.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11068 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11068 · Vendor Advisory
• https://vuldb.com/?submit.658064 · Note
• https://t.me/cveNotify/136704 · Telegram Post
• https://twitter.com/CVEnew/status/1971972198127505805 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971980694051021247 · Twitter Post
• https://vuldb.com/?id.326107 · Note
• https://t.me/CVEtracker/33545 · Telegram Post
• https://vuldb.com/?ctiid.326107 · Note