Priority MEDIUM 44
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-10-16 · No fix listed CWE-89
Priority HIGH 77
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00523 · Published 2026-10-16 · No fix listed CWE-89
Priority HIGH 81
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.0055 · Published 2026-10-16 · No fix listed CWE-306
Priority HIGH 72
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00507 · Published 2025-01-14 · No fix listed CWE-922
Priority HIGH 72
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00507 · Published 2025-01-14 · No fix listed CWE-922
Priority HIGH 82
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00638 · Published 2024-10-30 · No fix listed CWE-434
Priority HIGH 82
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00625 · Published 2024-09-24 · No fix listed CWE-321
Priority HIGH 68
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the Ch…
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00468 · Published 2024-09-24 · No fix listed CWE-284
Priority HIGH 66
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00667 · Published 2024-09-24 · No fix listed CWE-284
Priority HIGH 68
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00517 · Published 2024-09-24 · No fix listed CWE-284
Priority LOW 26
A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00695 · Published 2023-12-13 · No fix listed CWE-275
Priority LOW 39
A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00791 · Published 2023-12-13 · No fix listed CWE-284
Priority LOW 29
A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00641 · Published 2023-12-13 · No fix listed CWE-1018
Priority MEDIUM 41
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00969 · Published 2023-12-13 · No fix listed CWE-837
Priority LOW 25
A vulnerability was found in Thecosy IceCMS 2.0.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00738 · Published 2023-12-13 · No fix listed CWE-284
Priority HIGH 68
A vulnerability was found in Thecosy IceCMS 2.0.1.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00983 · Published 2023-12-13 · No fix listed CWE-200
Priority MEDIUM 45
A vulnerability was found in Thecosy IceCMS 2.0.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01288 · Published 2023-12-13 · No fix listed CWE-307
Priority LOW 19
A vulnerability was found in Thecosy IceCMS 2.0.1.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00618 · Published 2023-12-02 · No fix listed CWE-837
Priority LOW 28
A vulnerability was found in Thecosy IceCMS 2.0.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00608 · Published 2023-12-02 · No fix listed CWE-79
Priority LOW 25
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00704 · Published 2023-11-30 · No fix listed CWE-837
Priority MEDIUM 44
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00953 · Published 2023-10-12 · No fix listed
Priority LOW 25
IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00376 · Published 2023-05-25 · No fix listed CWE-79
Priority MEDIUM 40
IceCMS v1.0.0 has Insecure Permissions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00606 · Published 2023-05-25 · No fix listed
THREATIST.IORead the docs