CVE-2025-1556— westboy CicadasCMS Template Management system deserialization
Quick assessment
Affected
westboy CicadasCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CicadasCMS是中国westboy个人开发者的一款基于 SpringBoot Mybatis SpringSecurity Vue 开发的内容管理框架。 CicadasCMS 1.0版本存在代码问题漏洞，该漏洞源于Template Management组件的/system文件包含一个反序列化问题。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-1556
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
westboy CicadasCMS Template Management system deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system of the component Template Management. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
CicadasCMS 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CicadasCMS是中国westboy个人开发者的一款基于 SpringBoot Mybatis SpringSecurity Vue 开发的内容管理框架。 CicadasCMS 1.0版本存在代码问题漏洞，该漏洞源于Template Management组件的/system文件包含一个反序列化问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| westboy | CicadasCMS | 1.0 | - |
|
II. Public POCs for CVE-2025-1556
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-1556
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-1556 (2)
-
Submit #499520: westboy CicadasCMS 1.0 Server-Side Template Injection third-party-advisory
News Coverage for CVE-2025-1556 (1)
IV. Related Vulnerabilities
Same product: CicadasCMS
-
CVE-2026-108791
westboy CicadasCMS Template Management input TemplateControl -
CVE-2026-108790
westboy CicadasCMS Backend Template Editor save TemplateCont -
CVE-2026-10529
westboy CicadasCMS Task Scheduling Management ScheduleJobCon -
CVE-2026-10153
westboy CicadasCMS AbstractCacheManager.java search cross si -
CVE-2025-11289
westboy CicadasCMS Template Management TemplateFileServiceIm
Same vendor: westboy
-
CVE-2026-108791
westboy CicadasCMS Template Management input TemplateControl -
CVE-2026-108790
westboy CicadasCMS Backend Template Editor save TemplateCont -
CVE-2026-10529
westboy CicadasCMS Task Scheduling Management ScheduleJobCon -
CVE-2026-10153
westboy CicadasCMS AbstractCacheManager.java search cross si -
CVE-2025-11289
westboy CicadasCMS Template Management TemplateFileServiceIm
Same weakness: CWE-502
-
CVE-2026-108958
TensorLayer HDF5 Loading utils.py load_hdf5_graph deserializ -
CVE-2026-108947
yoshitomo-matsubara torchdistill main_util.py load_ckpt dese -
CVE-2026-109360
MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Ov -
CVE-2026-109361
MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nn -
CVE-2026-109237
Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Lea
V. Comments for CVE-2025-1556
No comments yet