Vulnerabilidades do Thecosy IceCMS
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Thecosy IceCMS: 3 registro(s), com versões afetadas e correções.
CVE-2026-111686
Alta · 7.5
CWE-89 16/10/2026
IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
CVE-2026-111685
Alta · 7.5
CWE-89 16/10/2026
IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
CVE-2026-111673
Crítica · 9.8
CWE-306 16/10/2026
IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.