Thecosy IceCMS vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Thecosy IceCMS: 3 record(s), with affected versions and fixes.

CVE-2026-111686 High · 7.5 CWE-89 Oct 16, 2026

IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

CVE-2026-111685 High · 7.5 CWE-89 Oct 16, 2026

IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.

CVE-2026-111673 Critical · 9.8 CWE-306 Oct 16, 2026

IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.