Icecms
Vendor:
First CVE: May 25, 2023 · Active for 3 years
20
Total CVEs
More Total CVEs than 95% of tracked products
6.7
Avg CVEs / Year
Higher CVE frequency than 93% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 45% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Icecms over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 25, 2023
3 years ago
Most Recent CVE
Jan 14, 2025
560 days ago
CVE Severity & Scoring
Icecms20 CVEs
35%
40%
20%
All CVEs353,173 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network20 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low19 (95.0%)
High1 (5.0%)
Unknown0 (0.0%)
User Interaction
None17 (85.0%)
Unknown0 (0.0%)
Required3 (15.0%)
Privileges Required
Low7 (35.0%)
High0 (0.0%)
None13 (65.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-46612CRITICAL IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information. | Sep 25, 2024 | 9.8 | 27 | NO | NO |
CVE-2024-48202CRITICAL icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. | Oct 30, 2024 | 9.8 | 26 | NO | NO |
CVE-2023-40833CRITICAL An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting. | Oct 12, 2023 | 9.8 | 26 | NO | NO |
CVE-2023-6756CRITICAL A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The m | Dec 13, 2023 | 9.8 | 25 | NO | NO |
CVE-2024-46609HIGH An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, inc | Sep 25, 2024 | 7.5 | 23 | NO | NO |
CVE-2023-6761HIGH A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. T | Dec 13, 2023 | 8.8 | 23 | NO | NO |
CVE-2023-33355HIGH IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information. | May 25, 2023 | 7.5 | 22 | NO | NO |
CVE-2024-46607HIGH Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the | Sep 25, 2024 | 7.6 | 21 | NO | NO |
CVE-2025-22984HIGH An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. | Jan 14, 2025 | 7.5 | 20 | NO | NO |
CVE-2025-22983HIGH An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. | Jan 14, 2025 | 7.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (20 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (20 CVEs).
Media Mentions
Signals from CVEs in this product scope (20 CVEs).
Top CNAs Publishing CVEs For Icecms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.2.0 | 2 | 7.5 | 0.5% | 0 | 0 |
| 2.0.1 | 10 | 6.2 | 0.8% | 0 | 0 |
| 1.0.0 | 3 | 7.6 | 0.6% | 0 | 0 |