| Titre | CicadasCMS 1.0 Code Injection |
|---|
| Description | CicadasCMS uses the Beetl template engine to process front-end templates, but it lacks strict filtering and escaping of user-controlled input in several interfaces. HTML files uploaded or edited by users are saved to the template directory by the system. When the application accesses the HTML file, the framework uses the Beetl engine to render it. |
|---|
| La source | ⚠️ https://gitee.com/westboy/CicadasCMS/issues/IDBPU6 |
|---|
| Utilisateur | formanagain (UID 93347) |
|---|
| Soumission | 09/12/2025 07:22 (il y a 10 mois) |
|---|
| Modérer | 13/12/2025 02:59 (4 days later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 327170 [westboy CicadasCMS Template Management Page TemplateFileServiceImpl.java save cross site scripting] |
|---|
| Points | 0 |
|---|