Approved changes feed: RSS · Atom
cpe:2.3:a:icecoder:icecoder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Icecoder (d2ff7761-7e45-59be-8f9e-35fdcb2c5150) |
|---|---|
| Product | Icecoder (42b7d17d-5224-5396-a86b-3c5751c13671) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/icecoder/icecoder |
purl2cpe | 2026-06-01 10:17:50.123594 |
pkg:sourceforge/icecoder |
purl2cpe | 2026-06-01 10:17:50.123597 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-64838 |
vulnerable | 2026-09-16 04:33:11.444089 |
ICEcoder through 8.1 Path Traversal via oldFileName Parameter
HIGH (8.3)
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.
Published: 2026-09-10T13:51:07.290Z
Updated: 2026-09-10T15:00:12.933Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64837 |
vulnerable | 2026-09-16 04:33:11.066031 |
ICEcoder through 8.1 OS Command Injection via lib/properties.php
HIGH (8.8)
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().
Published: 2026-09-10T13:51:06.008Z
Updated: 2026-09-10T14:55:28.809Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64836 |
vulnerable | 2026-09-16 04:33:10.742741 |
ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
HIGH (8.8)
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
Published: 2026-09-10T13:51:05.213Z
Updated: 2026-09-10T14:05:49.993Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41373 |
vulnerable | 2026-06-08 06:43:54.477093 |
Details available
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.
Published: 2024-07-26T00:00:00.000Z
Updated: 2024-08-02T04:46:52.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3862 |
vulnerable | 2026-06-08 05:33:54.470920 |
Cross-site Scripting (XSS) - Reflected in icecoder/icecoder
MEDIUM (5.4)
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2022-01-17T13:50:10.000Z
Updated: 2024-08-03T17:09:09.601Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.