Thecosy

Records23All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

Thecosy records in CISA KEV

No Thecosy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Icecms 20 records HIGH

Records

20 records in Icecms · all components

TI-2024-32301 CVE-2024-48202 · GHSA-pxm6-wc5v-cphj

icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.

HIGH 82

icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00638 Published 2024-10-30 No fix listed CWE-434

TI-2024-31064 CVE-2024-46612 · GHSA-hwr4-f3g6-5mmp

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an…

HIGH 82

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00625 Published 2024-09-24 No fix listed CWE-321

TI-2025-16813 CVE-2025-22984 · GHSA-qp84-727m-58qv

An access control issue in the component /api/squareComment/DelectSquareById of iceCMS…

HIGH 72

An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00507 Published 2025-01-14 No fix listed CWE-922

TI-2025-16812 CVE-2025-22983 · GHSA-v676-9fq8-rqq8

An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0…

HIGH 72

An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00507 Published 2025-01-14 No fix listed CWE-922

TI-2024-31063 CVE-2024-46610 · GHSA-f93h-pcqv-5rf7

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily…

HIGH 68

An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the Ch…

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00468 Published 2024-09-24 No fix listed CWE-284

TI-2024-31061 CVE-2024-46607 · GHSA-rm3j-jj6h-qrq4

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by…

HIGH 68

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00517 Published 2024-09-24 No fix listed CWE-284

TI-2023-06174 CVE-2023-6757 · GHSA-rg5v-45m6-6242

Thecosy IceCMS API PlanetUser information disclosure

HIGH 68

A vulnerability was found in Thecosy IceCMS 2.0.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00983 Published 2023-12-13 No fix listed CWE-200

TI-2024-31062 CVE-2024-46609 · GHSA-wx2g-pjx5-v6r9

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7…

HIGH 66

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00667 Published 2024-09-24 No fix listed CWE-284

TI-2023-06173 CVE-2023-6756 · GHSA-q8wg-hjx6-v9j8

Thecosy IceCMS Captcha login excessive authentication

MEDIUM 45

A vulnerability was found in Thecosy IceCMS 2.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01288 Published 2023-12-13 No fix listed CWE-307

TI-2023-21571 CVE-2023-40833 · GHSA-6pcv-gr86-c624

An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id…

MEDIUM 44

An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00953 Published 2023-10-12 No fix listed

TI-2023-06176 CVE-2023-6759 · GHSA-hr3w-f8mh-x6jr

Thecosy IceCMS Love resource improper enforcement of a single, unique action

MEDIUM 41

A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-12-13 No fix listed CWE-837

TI-2023-16496 CVE-2023-33355 · GHSA-xj65-984f-7j58

IceCMS v1.0.0 has Insecure Permissions.

MEDIUM 40

IceCMS v1.0.0 has Insecure Permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00606 Published 2023-05-25 No fix listed

TI-2023-06178 CVE-2023-6761 · GHSA-hxh6-gm53-6gm3

Thecosy IceCMS User Data access control

LOW 39

A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00791 Published 2023-12-13 No fix listed CWE-284

TI-2023-06177 CVE-2023-6760 · GHSA-47r7-qf7f-7433

Thecosy IceCMS user session

LOW 29

A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00641 Published 2023-12-13 No fix listed CWE-1018

TI-2023-05931 CVE-2023-6466 · GHSA-9m44-6f5v-p3rf

Thecosy IceCMS User Comment planet cross site scripting

LOW 28

A vulnerability was found in Thecosy IceCMS 2.0.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00608 Published 2023-12-02 No fix listed CWE-79

TI-2023-06179 CVE-2023-6762 · GHSA-w76m-mfcx-2wg8

Thecosy IceCMS Article permission

LOW 26

A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00695 Published 2023-12-13 No fix listed CWE-275

TI-2023-16497 CVE-2023-33356 · GHSA-4wqq-p5m8-mjr9

IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).

LOW 25

IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00376 Published 2023-05-25 No fix listed CWE-79

TI-2023-06175 CVE-2023-6758 · GHSA-rjmr-v75r-gm8f

Thecosy IceCMS API PlanetCommentList access control

LOW 25

A vulnerability was found in Thecosy IceCMS 2.0.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00738 Published 2023-12-13 No fix listed CWE-284

TI-2023-05908 CVE-2023-6438 · GHSA-qwf9-ch8q-fhx3

Thecosy IceCMS Like improper enforcement of a single, unique action

LOW 25

A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00704 Published 2023-11-30 No fix listed CWE-837

TI-2023-05932 CVE-2023-6467 · GHSA-7r3q-pp93-hcwf

Thecosy IceCMS Comment Like improper enforcement of a single, unique action

LOW 19

A vulnerability was found in Thecosy IceCMS 2.0.1.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00618 Published 2023-12-02 No fix listed CWE-837

Open these records in search →

Critical	5
High	10
Medium	7
Low	1
No CVSS	0