Is there a public PoC exploit available for CVE-2025-11289?

Yes, a public proof-of-concept exploit is available for CVE-2025-11289. Prioritise patching immediately. EPSS: 0.0%.

westboy CicadasCMS CVE-2025-11289

Q: What is the CVSS score of CVE-2025-11289?

CVE-2025-11289 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-10-05 cna@vuldb.com

Java XSS Cicadascms

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:51 vuln.today

DescriptionCVE.org

A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Management Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stored cross-site scripting (XSS) in westboy CicadasCMS Template Management Page allows high-privileged users to inject malicious scripts via the Save function in TemplateFileServiceImpl.java, affecting downstream users who interact with stored templates. The vulnerability requires high privileges and user interaction but carries CVSS 1.9 due to minimal integrity impact; however, publicly available exploit code exists, indicating real disclosure despite extremely low exploitation probability (EPSS 0.03%).

Technical ContextAI

The vulnerability exists in the Template Management component of CicadasCMS, specifically in the Save function of src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java. This is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue where user-supplied input in template files is not properly sanitized or encoded before being stored and rendered. Java-based web applications handling template content are susceptible to stored XSS when input validation and output encoding are insufficient. The affected CPE indicates CicadasCMS version 1.0 and potentially other versions up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab.

RemediationAI

No vendor-released patch is identified at time of analysis. Primary mitigation requires upgrading CicadasCMS to a patched version beyond commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, with version details available from https://github.com/westboy/CicadasCMS or via the vendor. Immediate compensating controls include: (1) restrict Template Management Page access to strictly necessary high-privilege users via role-based access control, reducing the attack surface; (2) implement Content Security Policy (CSP) headers with strict-dynamic and script-src restrictions to mitigate stored XSS payload execution in browsers; (3) enable HTML/JavaScript input validation and output encoding in template file processing, ensuring all user input is escaped before storage; (4) audit all existing templates for suspicious content and monitor template modification logs for unauthorized changes. Each mitigation has trade-offs: restricting access may reduce functionality, CSP may break legitimate dynamic content, and template scanning requires manual effort.