---
id: CVE-2026-111686
title: >-
  IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability
  that allows remote attackers to inject SQL through the num path parameter of
  /WebArticle/findarticlesbynum
summary: >-
  IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability
  that allows remote attackers to inject SQL through the num path parameter of
  /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the
  LIMIT cla…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: Thecosy
product: IceCMS
affected:
  - IceCMS <= 4.1.5
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T22:17:22.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111686'
references:
  - url: 'https://github.com/Thecosy/IceCMS'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/frontend/WebArticleController.java#L169-L175
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webarticle-findarticlesbynum
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00425
epssPercentile: 0.36557
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T20:52:39.678928Z'
ingestedAt: '2026-10-16T18:43:08.658Z'
---

## Overview

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.