Read the docs
TI-2026-75471 Aliases CVE-2026-111685GHSA-vqwq-cg9h-83m7

SQL injection in IceCMS lets remote attackers read database contents

Priority HIGH 77CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Thecosy IceCMS through 4.1.5 is affected. The num path parameter of /WebResource/findresourcebynum is concatenated into a SQL query after a LIMIT clause without neutralization, which is an SQL injection flaw (CWE-89). An unauthenticated remote attacker can append SQL to extract database contents using union-based or blind techniques.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ThecosyIceCMSup to 4.1.5—No fix listedCNA
  • IceCMS VendorThecosy Affected up to 4.1.5 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:*——Thecosy
  • cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:* Versions — — ·Thecosy

Remediation

The sources list no fixed version for IceCMS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111685
  2. 2026-10-16 Alias added: GHSA-vqwq-cg9h-83m7
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-19 CISA SSVC decision points changed
  5. 2026-10-19 Priority changed: LOW → HIGH

References

Advisory 1

Other 2

  • TI-2024-32301 icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. CVSS 3.1CRITICAL 9.8
  • TI-2024-31064 IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an… CVSS 3.1CRITICAL 9.8
  • TI-2026-75459 Missing authentication in IceCMS lets attackers take over accounts CVSS 4.0CRITICAL 9.3
  • TI-2025-16813 An access control issue in the component /api/squareComment/DelectSquareById of iceCMS… CVSS 3.1HIGH 7.5
  • TI-2025-16812 An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0… CVSS 3.1HIGH 7.5
  • TI-2024-31063 An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily… CVSS 3.1HIGH 7.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences