CVE-2026-111685highCWE-89

CVE-2026-111685: falha de alta gravidade em Thecosy IceCMS

IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar IceCMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Thecosy · IceCMS
CVEs relacionadas — Thecosy IceCMS

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6756MEDIUMThecosy IceCMS Captcha login excessive authenticationEPSS 1.3%CVE-2023-6757MEDIUMThecosy IceCMS API PlanetUser information disclosureEPSS 1.0%CVE-2023-6759MEDIUMThecosy IceCMS Love resource improper enforcement of a single, unique actionEPSS 1.0%CVE-2023-6761MEDIUMThecosy IceCMS User Data access controlEPSS 0.8%CVE-2023-6758MEDIUMThecosy IceCMS API PlanetCommentList access controlEPSS 0.7%CVE-2023-6438MEDIUMThecosy IceCMS Like improper enforcement of a single, unique actionEPSS 0.7%