4 matches found
CVE-2026-111685
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last to extract databa...
EUVD-2026-102976
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last to extract databa...
CVE-2026-111685
The IceCMS content management system, version 4.1.5 and below , is vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the /WebResource/findresourcebynum endpoint, where a crafted num path parameter allows remote attackers to inject SQL. Specifically, attackers can ap...
PT-2026-116084
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last to extract databa...