CVE-2025-11068: westboy CicadasCMS save cross site scripting

Published Sep 27, 2025

Updated

A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The manipulation of the argument categoryName results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

Affected Software

2 affected components

westboy CicadasCMS

westboy CicadasCMS=1.0

Event History

Sep 27, 2025

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11068?

CVE-2025-11068 is classified as a medium severity vulnerability due to its potential for remote exploitation via cross-site scripting.

How do I fix CVE-2025-11068?

To fix CVE-2025-11068, validate and sanitize the input for the categoryName parameter in the /system/cms/category/save file.

What type of vulnerability is CVE-2025-11068?

CVE-2025-11068 is a cross-site scripting (XSS) vulnerability.

Who is affected by CVE-2025-11068?

CVE-2025-11068 affects users of westboy CicadasCMS version 1.0.

Can CVE-2025-11068 be exploited remotely?

Yes, CVE-2025-11068 can be exploited remotely due to its nature as a cross-site scripting vulnerability.