CVE-2026-111686
HighCVSS 7.5Summary
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
Risk Assessment
An unauthenticated attacker can read arbitrary data from the database, including sensitive information. This leads to severe data leakage and potential further system compromise.
Recommendation
Upgrade IceCMS beyond 4.1.5 if available, or fix the vulnerable parameter by parameterizing queries. Consider deploying a WAF and monitoring for unusual requests.
Other vulnerabilities in IceCMS
See all- CVE-2026-111685High
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
- CVE-2026-111673Critical
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
- CVE-2023-36100Critical
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
- CVE-2024-46607High
In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.
- CVE-2023-33356Medium
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
- CVE-2023-33355High
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
Original NVD description (English source)
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS