Live › vulnerability › CVE-2026-111685
Go to dashboardIceCMS through 4.1.5 (no release tags; default-branch commit afd7a9f) concatenates the num path variable into QueryWrapper.last("limit " + num) in /WebResource/findresourcebynum/{content}/{num}. The /WebResource prefix is not in the Shiro JWT filter chain, so anonymous callers reach it. Union or blind SQLi reads the database. Stacked queries are not enabled by default, and no RCE is claimed. No patch is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| IceCMS | github | <= 4.1.5 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
This page as .md · .json · in your agent: get_signal("CVE-2026-111685")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.