https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-42322.htmlhttps://patchthecve.com/cve/CVE-2023-42322.htmlWed, 17 Jun 2026 06:23:43 +0000CRITICAL 9.8: Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.https://patchthecve.com/cve/CVE-2023-42321.htmlhttps://patchthecve.com/cve/CVE-2023-42321.htmlWed, 17 Jun 2026 06:23:43 +0000HIGH 8.8: Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.https://patchthecve.com/cve/CVE-2019-14976.htmlhttps://patchthecve.com/cve/CVE-2019-14976.htmlWed, 17 Jun 2026 02:19:26 +0000MEDIUM 6.1: iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.https://patchthecve.com/cve/CVE-2019-6259.htmlhttps://patchthecve.com/cve/CVE-2019-6259.htmlWed, 17 Jun 2026 02:38:53 +0000CRITICAL 9.8: An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter.https://patchthecve.com/cve/CVE-2018-18702.htmlhttps://patchthecve.com/cve/CVE-2018-18702.htmlWed, 17 Jun 2026 01:47:43 +0000CRITICAL 9.8: spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.https://patchthecve.com/cve/CVE-2018-16314.htmlhttps://patchthecve.com/cve/CVE-2018-16314.htmlWed, 17 Jun 2026 01:44:04 +0000HIGH 8.8: An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRF_TOKEN, if CSRF_TOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header.https://patchthecve.com/cve/CVE-2018-15895.htmlhttps://patchthecve.com/cve/CVE-2018-15895.htmlWed, 17 Jun 2026 01:43:17 +0000HIGH 7.5: An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an ihttps://patchthecve.com/cve/CVE-2018-14858.htmlhttps://patchthecve.com/cve/CVE-2018-14858.htmlWed, 17 Jun 2026 01:41:46 +0000HIGH 7.5: An SSRF vulnerability was discovered in idreamsoft iCMS before V7.0.11 because the remote function in app/spider/spider_tools.class.php does not block private and reserved IP addresses such as 10.0.0.0/8. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14514.https://patchthecve.com/cve/CVE-2018-14514.htmlhttps://patchthecve.com/cve/CVE-2018-14514.htmlWed, 17 Jun 2026 01:41:08 +0000CRITICAL 9.8: An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified other impact.https://patchthecve.com/cve/CVE-2018-14415.htmlhttps://patchthecve.com/cve/CVE-2018-14415.htmlWed, 17 Jun 2026 01:40:57 +0000MEDIUM 6.1: An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.https://patchthecve.com/cve/CVE-2018-12498.htmlhttps://patchthecve.com/cve/CVE-2018-12498.htmlWed, 17 Jun 2026 01:37:53 +0000CRITICAL 9.8: spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.https://patchthecve.com/cve/CVE-2018-10250.htmlhttps://patchthecve.com/cve/CVE-2018-10250.htmlWed, 17 Jun 2026 01:33:45 +0000MEDIUM 5.4: iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action, aka a WeChat Classified Management keyword search.https://patchthecve.com/cve/CVE-2018-10222.htmlhttps://patchthecve.com/cve/CVE-2018-10222.htmlWed, 17 Jun 2026 01:33:42 +0000HIGH 8.8: An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&do=save&frame=iPHP.https://patchthecve.com/cve/CVE-2018-10117.htmlhttps://patchthecve.com/cve/CVE-2018-10117.htmlWed, 17 Jun 2026 01:33:32 +0000HIGH 8.8: An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&do=save&frame=iPHP.https://patchthecve.com/cve/CVE-2018-9925.htmlhttps://patchthecve.com/cve/CVE-2018-9925.htmlWed, 17 Jun 2026 02:07:20 +0000MEDIUM 5.4: An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request.https://patchthecve.com/cve/CVE-2018-9924.htmlhttps://patchthecve.com/cve/CVE-2018-9924.htmlWed, 17 Jun 2026 02:07:20 +0000CRITICAL 9.8: An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request.https://patchthecve.com/cve/CVE-2018-9923.htmlhttps://patchthecve.com/cve/CVE-2018-9923.htmlWed, 17 Jun 2026 02:07:19 +0000HIGH 8.8: An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request.https://patchthecve.com/cve/CVE-2018-9922.htmlhttps://patchthecve.com/cve/CVE-2018-9922.htmlWed, 17 Jun 2026 02:07:19 +0000MEDIUM 5.3: An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname.