TH
Vendor
Thecosy
23
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111686 | IC IceCMS Thecosy | 7.5 | Oct 16 | IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum |
| CVE-2026-111685 | IC IceCMS Thecosy | 7.5 | Oct 16 | IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum |
| CVE-2026-111673 | IC IceCMS Thecosy | 9.8 | Oct 16 | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints |
| CVE-2025-22984 | IC Icecms Thecosy | 7.5 | Jan 14 | An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information |
| CVE-2025-22983 | IC Icecms Thecosy | 7.5 | Jan 14 | An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information |
| CVE-2024-48202 | IC Icecms Thecosy | 9.8 | Oct 30 | icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile |
| CVE-2024-46607 | IC Icecms Thecosy | 7.6 | Sep 24 | Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in… |
| CVE-2024-46612 | IC Icecms Thecosy | 9.8 | Sep 24 | IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information |
| CVE-2024-46610 | IC Icecms Thecosy | 7.5 | Sep 24 | An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to… |
| CVE-2024-46609 | IC Icecms Thecosy | 7.5 | Sep 24 | An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information,… |
| CVE-2023-6762 | IC IceCMS Thecosy | 4.3 | Dec 13 | Thecosy IceCMS Article permission |
| CVE-2023-6761 | IC IceCMS Thecosy | 8.8 | Dec 13 | Thecosy IceCMS User Data access control |
| CVE-2023-6760 | IC IceCMS Thecosy | 5.4 | Dec 13 | Thecosy IceCMS user session |
| CVE-2023-6759 | IC IceCMS Thecosy | 7.5 | Dec 13 | Thecosy IceCMS Love resource improper enforcement of a single, unique action |
| CVE-2023-6758 | IC IceCMS Thecosy | 4.3 | Dec 13 | Thecosy IceCMS API PlanetCommentList access control |
| CVE-2023-6757 | IC IceCMS Thecosy | 6.5 | Dec 13 | Thecosy IceCMS API PlanetUser information disclosure |
| CVE-2023-6756 | IC IceCMS Thecosy | 9.8 | Dec 13 | Thecosy IceCMS Captcha login excessive authentication |
| CVE-2023-6467 | IC IceCMS Thecosy | 3.7 | Dec 2 | Thecosy IceCMS Comment Like improper enforcement of a single, unique action |
| CVE-2023-6466 | IC IceCMS Thecosy | 6.1 | Dec 2 | Thecosy IceCMS User Comment planet cross site scripting |
| CVE-2023-6438 | IC IceCMS Thecosy | 5.3 | Nov 30 | Thecosy IceCMS Like improper enforcement of a single, unique action |
| CVE-2023-40833 | IC Icecms Thecosy | 9.8 | Oct 12 | An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting |
| CVE-2023-33356 | IC Icecms Thecosy | 5.4 | May 25 | IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-33355 | IC Icecms Thecosy | 7.5 | May 25 | IceCMS v1.0.0 has Insecure Permissions |