Thecosy operates a narrowly focused vulnerability profile centered on its IceCMS product, a web-based content management system with a surprisingly prominent position in the vulnerability landscape relative to the size of its product line. Vulnerabilities affecting this vendor skew toward serious outcomes, with an elevated share reaching critical severity, though the exposure concentrates in a compact product footprint. The recurring weakness classes span access control issues, insufficient information handling, single-action enforcement gaps, cross-site scripting flaws, and insecure sensitive-data storage, reflecting the authentication, session management, and input-validation demands of a web application serving as a central content hub. Defenders tracking this vendor should focus inventory and remediation efforts specifically on IceCMS deployments and review its access control and input-handling configurations, especially in internet-reachable instances; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Thecosy over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-46612CRITICAL IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information. | Sep 25, 2024 | 9.8 | 27 | NO | NO |
CVE-2024-48202CRITICAL icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. | Oct 30, 2024 | 9.8 | 26 | NO | NO |
CVE-2023-40833CRITICAL An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting. | Oct 12, 2023 | 9.8 | 26 | NO | NO |
CVE-2023-6756CRITICAL A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The m | Dec 13, 2023 | 9.8 | 25 | NO | NO |
CVE-2024-46609HIGH An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, inc | Sep 25, 2024 | 7.5 | 23 | NO | NO |
CVE-2023-6761HIGH A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. T | Dec 13, 2023 | 8.8 | 23 | NO | NO |
CVE-2023-33355HIGH IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information. | May 25, 2023 | 7.5 | 22 | NO | NO |
CVE-2024-46607HIGH Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the | Sep 25, 2024 | 7.6 | 21 | NO | NO |
CVE-2025-22984HIGH An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. | Jan 14, 2025 | 7.5 | 20 | NO | NO |
CVE-2025-22983HIGH An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. | Jan 14, 2025 | 7.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Thecosy.
Media articles that mention a CVE ID that affects a product developed by Thecosy — matched by CVE ID, not by vendor name.