Icz vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Icz products: 3 record(s), with severity, exploitation and fixes.

Matcha Invoice 2 Matcha Sns 1

Exploited only (KEV) →

CVE-2026-33273 High · 7.2 CWE-434 Apr 8, 2026

Unrestricted Upload of File with Dangerous Type in Icz Matcha Invoice

Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.

CVE-2026-27787 Medium · 5.4 CWE-79 Apr 8, 2026

Cross-site Scripting (XSS) in Icz Matcha Sns

Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.

CVE-2026-24913 High · 8.8 CWE-89 Apr 8, 2026

SQL Injection in Icz Matcha Invoice

SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained or altered by a user who can log in to the product.