CVE-2023-33356

IceCMS v1.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. The NVD entry cites CVSSv3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N with a base score of 5.4 (Medium). Root cause described in CNVD/PRION/Red Hat entries attributes the issue to inadequate filtering/escaping of user-supplied d...

CVE-2023-33355

IceCMS v1.0.0 is affected by an Insecure Permissions vulnerability that allows unauthorized access to the API and results in disclosure of sensitive information. The issue stems from improper access control in IceCMS, as described across multiple sources (e.g., CNVD, NVD/Red Hat records). Affecte...

CVE-2025-22984

CVE-2025-22984 refers to an access-control vulnerability in iceCMS v2.2.0, where the endpoint /api/squareComment/DelectSquareById can be accessed by unauthenticated users to retrieve sensitive information. The publicly available descriptions consistently identify an improper access-control mechan...

CVE-2024-46612

IceCMS v3.4.7 and earlier versions contain a hardcoded JWT key, enabling an attacker to forge JWT authentication information. Affected component is the authentication/key handling within IceCMS. Impact is authenticated access forgery with high severity as described in cited sources; exploitation ...

CVE-2024-48202

IceCMS

CVE-2025-22983

CVE-2025-22983 affects iceCMS v2.2.0. Affected component: /square/getAllSquare/circle, where improper access control allows unauthenticated attackers to access sensitive information. Root cause is an access-control issue; impact is information disclosure. Exploitation details are not provided in ...

CVE-2023-40833

The CVE-2023-40833 entry concerns Thecosy IceCMS v1.0.0. A remote attacker can gain privileges via the Id and key parameters in getCosSetting, with impact described as Confidentiality/Integrity/Availability High. Public sources consistently describe a privilege escalation/vector affecting getCosS...

CVE-2023-6438

The CVE-2023-6438 case affects IceCMS 2.0.1, specifically the /WebArticle/articles/ area within the Like Handler component. The root cause is an improper enforcement of a single, unique action in an unknown function, allowing remote exploitation. Public exploit information has been disclosed. For...

CVE-2024-46609

IceCMS vulnerability CVE-2024-46609 affects IceCMS v3.4.7 and earlier. The root cause is an access control flaw in the CheckVip function of UserController.java, allowing unauthenticated attackers to retrieve all user information, including passwords. The issue is consistently described across mul...

CVE-2024-46610

IceCMS v3.4.7 and earlier has an access control vulnerability allowing an attacker to arbitrarily modify user data (username, password) by sending a crafted POST to /User/ChangeUser/s in ChangeUser() of UserController.java. Connected documents (Red Hat, CNNVD, CVE records, PT-Security) corroborat...

CVE-2024-46607

IceCMS up to v3.4.7 is affected by an authentication bypass in the loginAdmin path of UserController.java, allowing login with arbitrary username and password and resulting in unauthorized access. The CVSS v3.1 base score is 7.6 (High): Network attack, low complexity, low privileges required, use...

CVE-2023-6466

The CVE-2023-6466 entry concerns Thecosy IceCMS 2.0.1. The vulnerability resides in the User Comment Handler component, affecting code in the /planet file, enabling cross-site scripting (XSS) via unfiltered user input. It is a remote, publicly disclosed issue affecting IceCMS. Observed impact per...

CVE-2023-6467

The CVE-2023-6467 entry concerns Thecosy IceCMS 2.0.1. The vulnerability affects the Comment Like Handler component, specifically the processing of the file /Websquare/likeClickComment/. The root cause is improper enforcement of a single, unique action, which could be triggered remotely. Exploita...

CVE-2023-6757

Thecosy IceCMS 2.0.1 exposes information via the API endpoint /adplanet/PlanetUser. The issue arises in an unknown API functionality, allowing remote access and information disclosure. Publicly disclosed exploits suggest potential attacker access without authentication, with confidentiality impac...

CVE-2023-6762

Thecosy IceCMS 2.0.1 is affected in the Article Handler component, via an unknown function in /article/DelectArticleById/. This leads to permission issues and can be exploited remotely. The vulnerability is described as critical across CVE-2023-6762 entries, with the exploit disclosed publicly. T...

CVE-2023-6758

The CVE-2023-6758 entry affects Thecosy IceCMS 2.0.1, specifically the API endpoint /adplanet/PlanetCommentList. The issue is an improper access control in an unknown functionality of that API component, with remote exploitation possible and public disclosure of the exploit. Multiple sources corr...

CVE-2023-6760

The CVE-2023-6760 entry applies to Thecosy IceCMS up to version 2.0.1. The vulnerability is described as affecting unknown code and enabling remote manipulation that leads to management of user sessions. Exploitation is noted as publicly disclosed. Connected sources corroborate impact on session ...

CVE-2023-6761

CVE-2023-6761 affects Thecosy IceCMS up to 2.0.1, where the User Data Handler’s processing allows improper access controls. The vulnerability can be exploited remotely and, per sources, the exploit has been disclosed publicly. The issue is rated HIGH (CVSSv3.1: 8.8) with network attack vector and...

CVE-2023-6759

The CVE-2023-6759 entry concerns Thecosy IceCMS 2.0.1, specifically the Love Handler component’s /WebResource/resource path. The vulnerability is described as a manipulation that leads to improper enforcement of a single, unique action. It is possible to initiate the attack remotely, and the expl...

CVE-2023-6756

The CVE-2023-6756 issue affects Thecosy IceCMS 2.0.1, specifically the Captcha Handler on the /login endpoint. The vulnerability allows attackers to bypass or excessive-restrict authentication attempts, with remote exploitation and public Exploit disclosure. Multiple connected sources confirm the...