CVE-2026-10153

MEDIUM

westboy CicadasCMS AbstractCacheManager.java search cross site scripting

Title source: cna
STIX 2.1

Description

A flaw has been found in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Impacted is the function Search of the file org/springframework/cache/support/AbstractCacheManager.java. This manipulation of the argument s causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-367406 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting
https://vuldb.com/vuln/367406
Signature, Permissions Required signature permissions-required
VDB-367406 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/367406/cti
Third Party Advisory third-party-advisory
Submit #818792 | https://gitee.com/westboy/CicadasCMS CicadasCMS v1.0 Cross-Site Request Forgery
https://vuldb.com/submit/818792

Scores

CVSS v3 4.3
EPSS 0.0042
EPSS Percentile 33.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
westboy/CicadasCMS 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Published May 30, 2026
Tracked Since May 31, 2026