Thecosy Icecms
23 CVEs affecting Thecosy Icecms. Latest disclosed: 2026-10-16. Critical: 4, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-111673 | Critical | 9.8 | 2026-10-16 | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /U… |
CVE-2024-48202 | Critical | 9.8 | 2024-10-30 | icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. |
CVE-2024-46612 | Critical | 9.8 | 2024-09-25 | IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information. |
CVE-2023-40833 | Critical | 9.8 | 2023-10-12 | An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting. |
CVE-2024-46607 | High | 7.6 | 2024-09-25 | Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the log… |
CVE-2026-111686 | High | 7.5 | 2026-10-16 | IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebA… |
CVE-2026-111685 | High | 7.5 | 2026-10-16 | IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path paramet… |
CVE-2025-22984 | High | 7.5 | 2025-01-14 | An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. |
CVE-2025-22983 | High | 7.5 | 2025-01-14 | An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. |
CVE-2024-46610 | High | 7.5 | 2024-09-25 | An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted P… |
CVE-2024-46609 | High | 7.5 | 2024-09-25 | An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all… |
CVE-2023-33355 | High | 7.5 | 2023-05-25 | IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information. |
CVE-2023-6760 | Medium | 6.3 | 2023-12-13 | A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user… |
CVE-2023-6762 | Medium | 5.4 | 2023-12-13 | A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ o… |
CVE-2023-33356 | Medium | 5.4 | 2023-05-25 | IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-6759 | Medium | 5.3 | 2023-12-13 | A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the compone… |
CVE-2023-6758 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/Pl… |
CVE-2023-6757 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-6756 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component C… |
CVE-2023-6761 | Medium | 4.3 | 2023-12-13 | A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component… |