Icz operates a suite of web-based applications focused on invoice management and social networking functionality, including products such as Matcha ASNs, Matcha Invoice, and related Sencha-based platforms. Its vulnerability profile centers durably on application-layer input-handling weaknesses—code injection, SQL injection, cross-site scripting, and cross-site request forgery—that recur across its web-facing product line and reflect the parsing and validation challenges inherent to form-driven and social-feature architectures. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Icz over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-24913HIGH SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained or altered by a user | Apr 8, 2026 | 8.8 | 30 | NO | NO |
CVE-2026-33273HIGH Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an adminis | Apr 8, 2026 | 7.2 | 29 | NO | NO |
CVE-2015-5645MEDIUM ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors. | Oct 6, 2015 | 6.5 | 23 | NO | NO |
CVE-2012-1237MEDIUM Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users. | Apr 6, 2012 | 6.8 | 22 | NO | NO |
CVE-2026-27787MEDIUM Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user wh | Apr 8, 2026 | 5.4 | 21 | NO | NO |
CVE-2015-5644MEDIUM The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors. | Oct 6, 2015 | 6.8 | 18 | NO | NO |
CVE-2015-5643MEDIUM The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors. | Oct 6, 2015 | 6.8 | 18 | NO | NO |
CVE-2015-5642MEDIUM Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | Oct 6, 2015 | 6.5 | 17 | NO | NO |
CVE-2012-1238MEDIUM Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors. | Apr 6, 2012 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Icz.
Media articles that mention a CVE ID that affects a product developed by Icz — matched by CVE ID, not by vendor name.