Unauthenticated SQL Injection Vulnerability in IceCMS by Thecosy

CVE-2026-111685

What is CVE-2026-111685?

IceCMS versions 4.1.5 and earlier are susceptible to an unauthenticated SQL injection vulnerability. Through the carefully crafted num path parameter in the /WebResource/findresourcebynum endpoint, attackers can exploit this flaw to execute arbitrary SQL queries. This opens the door for potential exposure of sensitive database contents, allowing for techniques such as union-based or blind SQL injection. Organizations utilizing IceCMS should urgently assess their versions and implement necessary mitigations to safeguard their databases.

References