CVE-2026-111686: IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerable endpoint is unauthenticated. A remote attacker can exploit it without credentials or user interaction by sending a crafted request to the affected WebArticle endpoint.
What is the likely impact if exploitation succeeds?
An attacker can inject SQL through the num path parameter and extract database contents using union-based or blind SQL injection techniques. The provided severity vector indicates high confidentiality impact, with no indicated integrity or availability impact.
Which deployments should be considered affected?
IceCMS versions through 4.1.5 should be considered affected if the /WebArticle/findarticlesbynum endpoint is reachable by an attacker.