Skip to content
OpenAdvisories

Vendor

Thecosy

13 known vulnerabilities.

Products

IceCMS 13
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-111673

    IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

    IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to…

    Thecosy IceCMS