CVE-2026-111686CWE-89sql-injection

CVE-2026-111686

High · published October 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-16T22:17Z
References (4)
https://github.com/Thecosy/IceCMS · [email protected]https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/frontend/WebArticleController.java#L169-L175 · [email protected]https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli · [email protected]https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webarticle-findarticlesbynum · [email protected]
EPSS history
Timeline
  • 18 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 16 OCT 17:39Z
    IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
    cvelistv5
  • 16 OCT 17:39Z
    IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
    cvelistv5