IC
Product
IceCMS
23
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 5High 10Medium 7Low 1
Watch
Add IceCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111673 | 9.8 | Oct 16 | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints Affected: through 4.1.5 |
| CVE-2024-48202 | 9.8 | Oct 30 | icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile Affected: through 3.4.7 |
| CVE-2024-46612 | 9.8 | Sep 24 | IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information Affected: before 3.4.7 |
| CVE-2023-6756 | 9.8 | Dec 13 | Thecosy IceCMS Captcha login excessive authentication Affected: 2.0.1 |
| CVE-2023-40833 | 9.8 | Oct 12 | An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting Affected: 1.0.0 |
| CVE-2023-6761 | 8.8 | Dec 13 | Thecosy IceCMS User Data access control Affected: 2.0.0; 2.0.1 |
| CVE-2024-46607 | 7.6 | Sep 24 | Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in… Affected: through 3.4.7 |
| CVE-2026-111686 | 7.5 | Oct 16 | IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum Affected: through 4.1.5 |
| CVE-2026-111685 | 7.5 | Oct 16 | IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum Affected: through 4.1.5 |
| CVE-2025-22984 | 7.5 | Jan 14 | An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information Affected: 2.2.0 |
| CVE-2025-22983 | 7.5 | Jan 14 | An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information Affected: 2.2.0 |
| CVE-2024-46609 | 7.5 | Sep 24 | An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information,… Affected: through 3.4.7 |
| CVE-2024-46610 | 7.5 | Sep 24 | An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to… Affected: through 3.4.7 |
| CVE-2023-6759 | 7.5 | Dec 13 | Thecosy IceCMS Love resource improper enforcement of a single, unique action Affected: 2.0.1 |
| CVE-2023-33355 | 7.5 | May 25 | IceCMS v1.0.0 has Insecure Permissions Affected: 1.0.0 |
| CVE-2023-6757 | 6.5 | Dec 13 | Thecosy IceCMS API PlanetUser information disclosure Affected: 2.0.1 |
| CVE-2023-6466 | 6.1 | Dec 2 | Thecosy IceCMS User Comment planet cross site scripting Affected: 2.0.1 |
| CVE-2023-6760 | 5.4 | Dec 13 | Thecosy IceCMS user session Affected: 2.0.0; 2.0.1 |
| CVE-2023-33356 | 5.4 | May 25 | IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS) Affected: 1.0.0 |
| CVE-2023-6438 | 5.3 | Nov 30 | Thecosy IceCMS Like improper enforcement of a single, unique action Affected: 2.0.1 |
| CVE-2023-6762 | 4.3 | Dec 13 | Thecosy IceCMS Article permission Affected: 2.0.1 |
| CVE-2023-6758 | 4.3 | Dec 13 | Thecosy IceCMS API PlanetCommentList access control Affected: 2.0.1 |
| CVE-2023-6467 | 3.7 | Dec 2 | Thecosy IceCMS Comment Like improper enforcement of a single, unique action Affected: 2.0.1 |
Showing 23