PatchTheCVE: icecmshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-22984: An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenthttps://patchthecve.com/cve/CVE-2025-22984.htmlhttps://patchthecve.com/cve/CVE-2025-22984.htmlWed, 17 Jun 2026 08:51:18 +0000HIGH 7.5: An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.CVE-2025-22983: An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated ahttps://patchthecve.com/cve/CVE-2025-22983.htmlhttps://patchthecve.com/cve/CVE-2025-22983.htmlWed, 17 Jun 2026 08:51:18 +0000HIGH 7.5: An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.CVE-2024-48202: icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.https://patchthecve.com/cve/CVE-2024-48202.htmlhttps://patchthecve.com/cve/CVE-2024-48202.htmlWed, 17 Jun 2026 07:58:17 +0000CRITICAL 9.8: icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.CVE-2024-46612: IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authhttps://patchthecve.com/cve/CVE-2024-46612.htmlhttps://patchthecve.com/cve/CVE-2024-46612.htmlWed, 17 Jun 2026 07:55:37 +0000CRITICAL 9.8: IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.CVE-2024-46610: An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information,https://patchthecve.com/cve/CVE-2024-46610.htmlhttps://patchthecve.com/cve/CVE-2024-46610.htmlWed, 17 Jun 2026 07:55:37 +0000HIGH 7.5: An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.javaCVE-2024-46609: An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unahttps://patchthecve.com/cve/CVE-2024-46609.htmlhttps://patchthecve.com/cve/CVE-2024-46609.htmlWed, 17 Jun 2026 07:55:36 +0000HIGH 7.5: An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwordsCVE-2024-46607: Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrarhttps://patchthecve.com/cve/CVE-2024-46607.htmlhttps://patchthecve.com/cve/CVE-2024-46607.htmlSun, 05 Jul 2026 01:20:41 +0000HIGH 7.6: Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.