TI-2024-32301 CVE-2024-48202 · GHSA-pxm6-wc5v-cphj
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
Priority HIGH 82
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
Thecosy
Records23All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
Thecosy records in CISA KEVNo Thecosy vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
23 records
TI-2024-31064 CVE-2024-46612 · GHSA-hwr4-f3g6-5mmp
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an…
Priority HIGH 82
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
TI-2026-75459 CVE-2026-111673 · GHSA-rgvr-v3r8-5gwx
Missing authentication in IceCMS lets attackers take over accounts
Priority HIGH 81
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter.
TI-2026-75471 CVE-2026-111685 · GHSA-vqwq-cg9h-83m7
SQL injection in IceCMS lets remote attackers read database contents
Priority HIGH 77
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum.
TI-2025-16813 CVE-2025-22984 · GHSA-qp84-727m-58qv
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS…
Priority HIGH 72
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
TI-2025-16812 CVE-2025-22983 · GHSA-v676-9fq8-rqq8
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0…
Priority HIGH 72
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
TI-2024-31063 CVE-2024-46610 · GHSA-f93h-pcqv-5rf7
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily…
Priority HIGH 68
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the Ch…
TI-2024-31061 CVE-2024-46607 · GHSA-rm3j-jj6h-qrq4
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by…
Priority HIGH 68
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
TI-2023-06174 CVE-2023-6757 · GHSA-rg5v-45m6-6242
Thecosy IceCMS API PlanetUser information disclosure
Priority HIGH 68
A vulnerability was found in Thecosy IceCMS 2.0.1.
TI-2024-31062 CVE-2024-46609 · GHSA-wx2g-pjx5-v6r9
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7…
Priority HIGH 66
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords
TI-2023-06173 CVE-2023-6756 · GHSA-q8wg-hjx6-v9j8
Thecosy IceCMS Captcha login excessive authentication
Priority MEDIUM 45
A vulnerability was found in Thecosy IceCMS 2.0.1.
TI-2026-75472 CVE-2026-111686 · GHSA-hgc3-v7wx-g8w8
IceCMS SQL Injection via num parameter in /WebArticle/findarticlesbynum
Priority MEDIUM 44
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum.
TI-2023-21571 CVE-2023-40833 · GHSA-6pcv-gr86-c624
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id…
Priority MEDIUM 44
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting.
TI-2023-06176 CVE-2023-6759 · GHSA-hr3w-f8mh-x6jr
Thecosy IceCMS Love resource improper enforcement of a single, unique action
Priority MEDIUM 41
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.
TI-2023-16496 CVE-2023-33355 · GHSA-xj65-984f-7j58
IceCMS v1.0.0 has Insecure Permissions.
Priority MEDIUM 40
IceCMS v1.0.0 has Insecure Permissions.
TI-2023-06178 CVE-2023-6761 · GHSA-hxh6-gm53-6gm3
Thecosy IceCMS User Data access control
Priority LOW 39
A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1.
TI-2023-06177 CVE-2023-6760 · GHSA-47r7-qf7f-7433
Thecosy IceCMS user session
Priority LOW 29
A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1.
TI-2023-05931 CVE-2023-6466 · GHSA-9m44-6f5v-p3rf
Thecosy IceCMS User Comment planet cross site scripting
Priority LOW 28
A vulnerability was found in Thecosy IceCMS 2.0.1.
TI-2023-06179 CVE-2023-6762 · GHSA-w76m-mfcx-2wg8
Thecosy IceCMS Article permission
Priority LOW 26
A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1.
TI-2023-16497 CVE-2023-33356 · GHSA-4wqq-p5m8-mjr9
IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).
Priority LOW 25
IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).
TI-2023-06175 CVE-2023-6758 · GHSA-rjmr-v75r-gm8f
Thecosy IceCMS API PlanetCommentList access control
Priority LOW 25
A vulnerability was found in Thecosy IceCMS 2.0.1.
TI-2023-05908 CVE-2023-6438 · GHSA-qwf9-ch8q-fhx3
Thecosy IceCMS Like improper enforcement of a single, unique action
Priority LOW 25
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.
TI-2023-05932 CVE-2023-6467 · GHSA-7r3q-pp93-hcwf
Thecosy IceCMS Comment Like improper enforcement of a single, unique action
Priority LOW 19
A vulnerability was found in Thecosy IceCMS 2.0.1.