Threat database

CVE-2026-108791 is a path traversal vulnerability in westboy CicadasCMS affecting the TemplateController.input function in the Template Management component. The vulnerability allows remote attackers to manipulate the filePath argument to traverse directories. The vendor has not responded to the disclosure, and no patch or remediation information is available. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity).

CVE-2026-108790 is a path traversal vulnerability in westboy CicadasCMS affecting the TemplateController.save function in the Backend Template Editor component. The flaw allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. Public exploit code has been released, increasing the risk of exploitation.

CVE-2026-10529 is a medium severity cross-site scripting (XSS) vulnerability in westboy CicadasCMS, specifically in an unknown function within the Task Scheduling Management Module (ScheduleJobController.java). The vulnerability allows remote attackers to execute XSS attacks by manipulating input. The product uses a rolling release model, so exact affected or fixed versions are not clearly defined. No official patch or remediation has been provided by the vendor as of the publication date. Exploit code is publicly available, but no known widespread exploitation has been reported.

CVE-2026-10153 is a medium severity cross-site scripting (XSS) vulnerability in westboy CicadasCMS affecting the Search function in the file org/springframework/cache/support/AbstractCacheManager.java. The vulnerability allows remote attackers to manipulate an argument to execute script code in a victim's browser. The product uses a rolling release model, so specific affected or fixed versions are not detailed. The project has been informed but has not yet responded or issued a fix. Exploit code has been published, but no known widespread exploitation is reported.

A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Management Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.