Thecosy vulnerabilities
We track 10 vulnerabilities in Thecosy products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Thecosy vulnerabilities
- 7.5 High severity
IceCMS: Improper Neutralization of Special Elements used in an SQL Command
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a
- 7.5 High severity
IceCMS: Improper Neutralization of Special Elements used in an SQL Command
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated vi
- 9.8 Critical severity
IceCMS: Missing Authentication for Critical Functionality
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to
- 7.5 High severity
Icecms: Insecure Storage of Sensitive Information
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
- 7.5 High severity
Icecms: Insecure Storage of Sensitive Information
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
- 7.5 High severity
icecms: Improper Access Control
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java
- 7.6 High severity
icecms: Improper Access Control
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
- 8.8 High severity
IceCMS: Improper Access Control
A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. The manipulation leads to improper access controls. The attack may be initiated r
- 7.5 High severity
IceCMS: Improper Enforcement of a Single, Unique Action
A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the component Love Handler. The manipulation leads to improper enforcement of a single, unique action. It is pos
- 9.8 Critical severity
IceCMS: Improper Restriction of Excessive Authentication Attempts
A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts.