CVE-2026-10529
Description
CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab is vulnerable to stored XSS via the task scheduling module's jobName parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab is vulnerable to stored XSS via the task scheduling module's jobName parameter.
Vulnerability
A stored cross-site scripting (XSS) vulnerability exists in the task scheduling management module of CicadasCMS, specifically in the /system/schedule/save interface, affecting versions up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The jobName parameter is not properly filtered or escaped, allowing for the injection of malicious JavaScript code.
Exploitation
An attacker can exploit this vulnerability by sending a crafted request to the /system/schedule/save endpoint with malicious JavaScript in the jobName parameter. This payload is then stored in the database. When an administrator or authorized user views the task list or monitoring page, the injected script will execute within their browser.
Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, unauthorized data modification, or redirection to malicious websites, depending on the privileges of the user viewing the compromised task.
Mitigation
CicadasCMS uses a rolling release model, and specific version information for affected or updated releases is unavailable. The project was notified early, but no official patch or fix has been released as of the available references. Users are advised to monitor the project for any future updates or security advisories. The project has not responded to the issue report [1].
AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <2431154dac8d0735e04f1fd2a3c3556668fc8dab
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The task saving interface fails to filter and escape user-input `jobName` parameter, allowing for script injection."
Attack vector
An attacker can exploit this vulnerability by sending a crafted POST request to the `/system/schedule/save` interface. The `jobName` parameter can contain malicious JavaScript code. This script is then stored in the server's database. When an administrator or a user with relevant permissions accesses the task list or scheduling monitoring page, the stored script executes within their browser environment, leading to a cross-site scripting attack [ref_id=1]. The attack can be executed remotely.
Affected code
The vulnerability resides in the task scheduling management module, specifically within the `ScheduleJobController.java` file. The `save` method in this controller passes data directly to the `ScheduleJobServiceImpl.java` without adequate XSS filtering. The `update` method within the service implementation then saves this unsanitized data to the database [ref_id=1].
What the fix does
The advisory recommends input filtering and output encoding to mitigate this vulnerability. Specifically, it suggests performing strict type validation and special character filtering on all user input data. Additionally, it recommends using functions like htmlspecialchars() at all HTML output locations to convert characters such as <, >, &, ", and ' to HTML entities. Implementing a Content Security Policy (CSP) is also suggested to restrict script execution. No patch is provided in the bundle.
Preconditions
- authThe attacker needs to have administrative or relevant permissions to access the task saving interface and trigger the stored script execution.
- inputThe attacker must provide a malicious payload within the `jobName` parameter.
Reproduction
Access http://127.0.0.1:12345/system to enter the plan management window. Click to edit a task. In the task name field, enter a payload such as `<script>alert(1)</script>`. Click save. Refresh the page and click the Scheduled Tasks window again. A pop-up window will appear, confirming the stored XSS vulnerability [ref_id=1].
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.