Live › vulnerability › CVE-2026-111686
Go to dashboardIceCMS through 4.1.5 (Spring Boot, Apache Shiro, MyBatis-Plus) concatenates the String path variable num into QueryWrapper.last("limit " + num) in GET /WebArticle/findarticlesbynum/{content}/{num}. /WebArticle is not in the Shiro jwt filter chain, so any anonymous caller can append SQL after LIMIT and read the database with union or blind injection. Stacked queries are not available by default (allowMultiQueries not set). No public exploit and no known exploitation. No upstream fix is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| IceCMS | github | <= 4.1.5 (commit afd7a9f) | – |
4.1.5, commit afd7a9f or earlier) and the backend is reachableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
This page as .md · .json · in your agent: get_signal("CVE-2026-111686")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.