Vulnerabilities

TI-2026-46363 CVE-2026-64838 · GHSA-3pmq-2635-wc4w

ICEcoder through 8.1 Path Traversal via oldFileName Parameter

HIGH 73

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0052 Published 2026-09-10 No fix listed CWE-22

TI-2026-46362 CVE-2026-64837 · GHSA-32c3-7gmv-f9ch

ICEcoder through 8.1 OS Command Injection via lib/properties.php

MEDIUM 41

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00811 Published 2026-09-10 No fix listed CWE-78

TI-2026-46361 CVE-2026-64836 · GHSA-wx3p-7qfr-rqrp

ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

MEDIUM 41

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00606 Published 2026-09-10 No fix listed CWE-22

TI-2026-45312 CVE-2026-63722 · GHSA-pv36-wq83-c2v7

ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

HIGH 79

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsani…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01329 Published 2026-08-19 No fix listed CWE-306

TI-2024-27616 CVE-2024-41375 · GHSA-5j47-3m62-7vr3

ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php

MEDIUM 60

ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00339 Published 2024-07-26 No fix listed CWE-79

TI-2024-27615 CVE-2024-41374 · GHSA-xcr9-pm5w-gvh2

ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php

MEDIUM 60

ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00339 Published 2024-07-26 No fix listed CWE-79

TI-2024-27614 CVE-2024-41373 · GHSA-x38c-v778-w56m

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.

MEDIUM 61

ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00441 Published 2024-07-26 No fix listed CWE-22

TI-2022-15006 CVE-2022-34026 · GHSA-fvf5-xp83-vrqp

ICEcoder v8.1 allows attackers to execute a directory traversal.

HIGH 72

ICEcoder v8.1 allows attackers to execute a directory traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01753 Published 2022-09-22 No fix listed CWE-22

TI-2021-02793 CVE-2021-3862 · GHSA-73q9-7pwj-gm46

Cross-site Scripting (XSS) - Reflected in icecoder/icecoder

LOW 23

icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00665 Published 2022-01-17 Fixed in 8.1 CWE-79

TI-2021-12057 CVE-2021-32106 · GHSA-jf9v-q8vh-3fmc

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the…

LOW 26

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00859 Published 2021-06-08 Fixed in 8.1 CWE-79

Vulnerabilities

Filters