Unauthenticated SQL Injection in IceCMS 4.1.5
CVE-2026-111686

8.7HIGH

Key Information:

Vendor

Thecosy

Status
Icecms
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111686?

IceCMS versions up to 4.1.5 are susceptible to an unauthenticated SQL injection vulnerability. This flaw enables remote attackers to craft malicious SQL queries through the 'num' path parameter of the /WebArticle/findarticlesbynum endpoint. By exploiting this vulnerability, attackers can append SQL code after the LIMIT clause, leveraging MyBatis-Plus QueryWrapper to extract sensitive data from the database using techniques like union-based or blind SQL injection.

Affected Version(s)

IceCMS 0 <= 4.1.5

References

https://hackmd.io/@hieuPenguinnn/icecms-webresource-webar...
third-party-advisory
https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c...
technical-description
https://github.com/Thecosy/IceCMS
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.