This vulnerability affects westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. It exists in an unspecified function of the Task Scheduling Management Module's ScheduleJobController.java file. The flaw allows remote attackers to perform cross-site scripting (XSS) attacks by injecting malicious input that is not properly sanitized or escaped. The vulnerability was reported early to the project, but no response or fix has been issued. The rolling release nature of the product means no specific version numbers are available to delineate affected or fixed releases. The CVSS 4.0 base score is 4.8 (medium), reflecting network attack vector, low attack complexity, and partial impact on integrity and availability.

Successful exploitation of this vulnerability enables remote attackers to execute cross-site scripting attacks against users of the CicadasCMS Task Scheduling Management Module. This could lead to the execution of arbitrary scripts in the context of the affected web application, potentially resulting in session hijacking, defacement, or other client-side impacts. The CVSS vector indicates no impact on confidentiality, limited impact on integrity and availability, and requires user interaction with low complexity. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available for this vulnerability. The vendor has not responded to the issue report. Users should monitor the vendor's communications for updates or fixes. In the meantime, applying web application firewall (WAF) rules to detect and block XSS payloads targeting the Task Scheduling Management Module may provide some mitigation. Avoiding use or limiting access to the affected module until a fix is available is recommended.