westboy CicadasCMS

Published Atomicorp research notes for CVEs affecting westboy CicadasCMS where WAF protections were observed during testing or engineering review.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

CVEVulnerabilityCVSSSeverityRules Observed
CVE-2026-10153westboy CicadasCMS AbstractCacheManager.java search cross site scripting2.1 (v4.0)Low333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-108791westboy CicadasCMS Template Management input TemplateController.input path traversal2.1 (v4.0)Low340007 , 344360 , 347009 , 390709
CVE-2026-108790westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal2.0 (v4.0)Low340007 , 344360 , 390709
CVE-2025-11068westboy CicadasCMS save cross site scripting1.9 (v4.0)Low333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148
CVE-2025-11069westboy CicadasCMS Add Department save cross site scripting1.9 (v4.0)Low333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2025-11289westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting1.9 (v4.0)Low333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-10529westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting1.9 (v4.0)Low333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 344370 , 346755 , 350147 , 350148