Is there a public PoC exploit available for CVE-2026-10529?

Yes, a public proof-of-concept exploit is available for CVE-2026-10529. Prioritise patching immediately. EPSS: 0.0%.

CicadasCMS CVE-2026-10529

Q: What is the CVSS score of CVE-2026-10529?

CVE-2026-10529 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33855 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 VulDB

GHSA-rgqh-84xv-78p8

XSS Java Cicadascms

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 02, 2026 - 02:22 NVD

2.4 (LOW) 1.9 (LOW)

Analysis Generated

Jun 02, 2026 - 01:42 vuln.today

DescriptionCVE.org

A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Impacted is an unknown function of the file src/main/java/com/zhiliao/module/web/system/ScheduleJobController.java of the component Task Scheduling Management Module. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Cross-site scripting in westboy CicadasCMS Task Scheduling Management Module allows a high-privileged, authenticated attacker to inject malicious script payloads via the ScheduleJobController component that execute in a victim user's browser upon viewing the affected page. The vulnerability carries a CVSS base score of just 2.4, reflecting the steep access barriers of required high privileges (PR:H) and mandatory user interaction (UI:R), though a publicly available proof-of-concept exploit exists on the Gitee issue tracker. No active exploitation has been confirmed by CISA KEV, and the vendor has not responded to the responsible disclosure report, meaning no patch is available at time of analysis.

Technical ContextAI

CicadasCMS is a Java-based content management system developed by westboy, identified by CPE cpe:2.3:a:westboy:cicadascms:*:*:*:*:*:*:*:*. The vulnerability resides in src/main/java/com/zhiliao/module/web/system/ScheduleJobController.java, which handles the Task Scheduling Management Module - a backend administrative feature for defining and managing scheduled jobs. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input submitted to the scheduler interface is not adequately sanitized or encoded before being rendered back in the administrative UI, enabling script injection. The project uses a rolling release model with no discrete versioned releases, making version-based remediation tracking difficult; the affected codebase is pinned to all commits up to and including 2431154dac8d0735e04f1fd2a3c3556668fc8dab.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor was notified via the Gitee issue tracker (https://gitee.com/westboy/CicadasCMS/issues/IJLMAG) but has not responded. Organizations running CicadasCMS should monitor the upstream repository at https://gitee.com/westboy/CicadasCMS/ for a remediation commit and apply it promptly when available. As a compensating control, access to the Task Scheduling Management Module should be restricted to the minimum number of trusted administrators necessary, using network-level controls (firewall rules, VPN gating, or IP allowlisting on the admin panel path) to reduce the pool of users who could both inject and trigger the XSS. Deploying a web application firewall with XSS filtering rules on the administrative interface can reduce exploitation risk, though WAF rules for stored XSS are bypassable and should not be treated as a complete fix. Audit administrator accounts to ensure no unauthorized high-privilege sessions exist that could be used to inject payloads.