Search
Search Results (10 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64837 | 1 Icecoder | 1 Icecoder | 2026-09-10 | 8.8 High |
| ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen(). | ||||
| CVE-2026-64836 | 1 Icecoder | 1 Icecoder | 2026-09-10 | 8.8 High |
| ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root. | ||||
| CVE-2026-64838 | 1 Icecoder | 1 Icecoder | 2026-09-10 | 8.3 High |
| ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals. | ||||
| CVE-2026-63722 | 1 Icecoder | 1 Icecoder | 2026-08-21 | 9.8 Critical |
| ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user. | ||||
| CVE-2022-34026 | 1 Icecoder | 1 Icecoder | 2025-05-27 | 7.5 High |
| ICEcoder v8.1 allows attackers to execute a directory traversal. | ||||
| CVE-2024-41375 | 1 Icecoder | 1 Icecoder | 2025-04-22 | 6.1 Medium |
| ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php | ||||
| CVE-2024-41374 | 1 Icecoder | 1 Icecoder | 2025-04-22 | 6.1 Medium |
| ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php | ||||
| CVE-2024-41373 | 1 Icecoder | 1 Icecoder | 2025-04-22 | 6.3 Medium |
| ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. | ||||
| CVE-2021-3862 | 1 Icecoder | 1 Icecoder | 2024-11-21 | 4.8 Medium |
| icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2021-32106 | 1 Icecoder | 1 Icecoder | 2024-11-21 | 5.4 Medium |
| In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed. | ||||
Page 1 of 1.