Icecoder

10 CVEs across 2 Icecoder products. Browse Icecoder vulnerabilities, severities, and proof-of-concept exploits.

Icecoder products with known CVEs

ProductCVEs
Icecoder10
Icecoder/icecoder1
Icecoder CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-64838High8.32026-09-10ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate…
CVE-2026-64837High8.82026-09-10ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through…
CVE-2026-64836High8.82026-09-10ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check…
CVE-2026-63722Critical9.82026-08-19ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining…
CVE-2024-41375Medium6.12024-07-26ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php
CVE-2024-41374Medium6.12024-07-26ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php
CVE-2024-41373Medium6.32024-07-26ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.
CVE-2022-34026High7.52022-09-22ICEcoder v8.1 allows attackers to execute a directory traversal.
CVE-2021-3862Medium4.82022-01-17icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-32106Medium5.42021-06-08In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] va…