CVE-2026-111686

HIGH 7.5

IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

CWE	CWE-89
Vendor	thecosy
Product	icecms
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for thecosy icecms

Be the first to know when new high vulnerabilities affecting thecosy icecms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Thecosy / IceCMS

0 ≤ 4.1.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli github.com: https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/frontend/WebArticleController.java#L169-L175 github.com: https://github.com/Thecosy/IceCMS vulncheck.com: https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webarticle-findarticlesbynum

Credits

hieuPenguinnn