Read the docs
TI-2026-75472 Aliases CVE-2026-111686GHSA-hgc3-v7wx-g8w8

IceCMS SQL Injection via num parameter in /WebArticle/findarticlesbynum

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

IceCMS through 4.1.5 by Thecosy contains an unauthenticated SQL injection flaw in the num path parameter of /WebArticle/findarticlesbynum. The num value is concatenated into a MyBatis-Plus QueryWrapper after the LIMIT clause, so input is not neutralized before it reaches the SQL command (CWE-89). A remote attacker without credentials can append crafted SQL to extract database contents using union-based or blind techniques.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ThecosyIceCMSup to 4.1.5—No fix listedCNA
  • IceCMS VendorThecosy Affected up to 4.1.5 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:*——Thecosy
  • cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:* Versions — — ·Thecosy

Remediation

The sources list no fixed version for IceCMS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111686
  2. 2026-10-16 Alias added: GHSA-hgc3-v7wx-g8w8
  3. 2026-10-18 CISA SSVC decision points changed

References

Advisory 1

Other 2

  • TI-2024-32301 icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. CVSS 3.1CRITICAL 9.8
  • TI-2024-31064 IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an… CVSS 3.1CRITICAL 9.8
  • TI-2026-75459 Missing authentication in IceCMS lets attackers take over accounts CVSS 4.0CRITICAL 9.3
  • TI-2026-75471 SQL injection in IceCMS lets remote attackers read database contents CVSS 4.0HIGH 8.7
  • TI-2025-16813 An access control issue in the component /api/squareComment/DelectSquareById of iceCMS… CVSS 3.1HIGH 7.5
  • TI-2025-16812 An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0… CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences