Thecosy
Thecosy Security Releases - October 2026
thecosy-2026-10 Oct 1, 2026 Source: Vendor
Thecosy security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-111673
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-111673
BR2026-0000-034627
IceCMS
unclaimed
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt ...
Credited as hieuPenguinnn
CVE-2026-111685
BR2026-0000-034639
IceCMS
unclaimed
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. ...
Credited as hieuPenguinnn
CVE-2026-111686
BR2026-0000-034640
IceCMS
unclaimed
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers ca...
Credited as hieuPenguinnn