CVE-2025-11289
BaseFortify
Publication date: 2025-10-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| westboy | cicadascms | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11289 is a stored cross-site scripting (XSS) vulnerability in CicadasCMS. It occurs because the system does not properly filter or escape user input before saving it in the template management component. Attackers can inject malicious scripts through the administration interface, which are then stored on the server. When other users view pages containing this injected content, the malicious scripts execute in their browsers, potentially leading to session hijacking, leakage of sensitive information like cookies, unauthorized user action simulation, and page content tampering. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the browsers of users who access the affected pages. This can result in session hijacking, theft of sensitive information such as cookies, unauthorized actions performed on behalf of users, and manipulation of page content. Exploitation requires some level of authentication and user interaction but can be initiated remotely. There are currently no known mitigations, so the affected component or product should be replaced to avoid these risks. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for attempts to inject malicious scripts via the template management interface, particularly targeting the save function in TemplateFileServiceImpl.java. Since the exploit requires authenticated access and user interaction, detection can include reviewing logs for suspicious input patterns or payloads in the template management requests. There is a publicly available proof-of-concept exploit on GitHub which can be used to test detection capabilities. Specific commands are not provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected component or product, as no known countermeasures or mitigations are currently available. It is recommended to avoid using vulnerable versions of CicadasCMS and monitor for updates or patches from the vendor. Additionally, restricting access to the template management interface and enforcing strict authentication can reduce risk. [2]