CVE-2026-111685 Thecosy CVE debrief

Who should care

Defenders responsible for IceCMS installations, especially those with publicly accessible /WebResource/findresourcebynum endpoints, should assess exposure and potential for SQL injection attacks.

Why it matters

CVE-2026-111685 is a SQL injection vulnerability in IceCMS through version 4.1.5, allowing remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Defenders should prioritize verifying exposure and assessing potential for SQL injection attacks.

• Verify exposure of IceCMS installations to SQL injection attacks
• Assess potential for data extraction or modification via SQL injection
• Implement compensating controls to prevent SQL injection attacks
• Monitor for suspicious activity and implement logging and exception tracking

Technical summary

The vulnerability exists in IceCMS through version 4.1.5 and allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. The CVSS score for this vulnerability is 8.7, indicating HIGH severity. This vulnerability could allow attackers to extract database contents using union-based or blind techniques. Defenders should prioritize verifying exposure of IceCMS installations, especially those with publicly accessible /WebResource/findresourcebynum endpoints, and assess the potential for SQL injection attacks. IceCMS users should review their installations and implement compensating controls to prevent SQL injection attacks.

Defensive priority

Defenders should prioritize verifying exposure of IceCMS installations, especially those with publicly accessible /WebResource/findresourcebynum endpoints, and assess the potential for SQL injection attacks.

Recommended defensive actions

• Verify IceCMS installations for exposure, especially those with publicly accessible /WebResource/findresourcebynum endpoints
• Assess the potential for SQL injection attacks and implement compensating controls
• Monitor for suspicious activity and implement logging and exception tracking
• Review vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in IceCMS through version 4.1.5 and the CVSS score of 8.7. The vulnerability allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Defenders should verify exposure of IceCMS installations and assess potential for SQL injection attacks. The source item provides additional information on the vulnerability, and defenders should review this information to understand the vulnerability and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.