GCVE - cpe:2.3:a:idreamsoft:icms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:idreamsoft:icms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Idreamsoft (`8dc9c6b3-ee1e-5503-bd32-7dec8bf59e6e`)
Product	Icms (`07f2e674-c405-509d-84c4-44096bcb9a3e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-15394`	vulnerable	2026-06-08 07:06:36.173025	iCMS POST Parameter ConfigAdmincp.php save code injection MEDIUM (4.7) A vulnerability was detected in iCMS up to 8.0.0. Affected is the function Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handler. The manipulation of the argument config results in code injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-12-31T19:02:14.256Z Updated: 2026-01-02T19:42:59.224Z Open on db.gcve.eu Reference links https://vuldb.com/?id.339163 https://vuldb.com/?ctiid.339163 https://vuldb.com/?submit.719029 https://note-hxlab.wetolink.com/share/QWuWZeAmzUdm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-44978`	vulnerable	2026-06-08 05:36:47.667102	Details available iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. Published: 2022-02-04T15:29:52.000Z Updated: 2024-08-04T04:32:13.601Z Open on db.gcve.eu Reference links https://www.icmsdev.com/ https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C0day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-44977`	vulnerable	2026-06-08 05:36:47.666706	Details available In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. Published: 2022-02-04T15:35:33.000Z Updated: 2024-08-04T04:32:13.585Z Open on db.gcve.eu Reference links https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%960day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-8902`	vulnerable	2026-06-08 05:14:24.646610	Details available An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI. Published: 2019-02-18T14:00:00.000Z Updated: 2024-09-16T20:59:06.326Z Open on db.gcve.eu Reference links https://github.com/idreamsoft/iCMS/issues/56	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Icms

Notes

PURL mappings

Vulnerability references

Contribute