IceCMS versions 4.1.5 and earlier contain an unauthenticated SQL injection flaw in the /WebArticle/findarticlesbynum endpoint. The vulnerability allows attackers to append crafted SQL statements after the LIMIT clause, which is concatenated into a MyBatis‑Plus QueryWrapper. As a result, union‑based or blind techniques can be used to read sensitive data from the database. The CVSS base score of 8.7 indicates a high‑severity risk and the absence of a fix in the CVE description means the flaw remains exploitable for remote attackers.

The affected product is IceCMS by Thecosy, with all releases up to and including version 4.1.5 vulnerable. Versions newer than 4.1.5 are not listed as affected, implying that a patch or upgrade has been applied to those releases.

The flaw is exploitable without authentication, relying on a standard web request to /WebArticle/findarticlesbynum. Although the EPSS score is not available, the high CVSS rating signals a serious threat. The vulnerability is not yet listed in CISA KEV, but it remains a priority for remediation due to its potential to expose confidential database information and its low effort attack path via HTTP requests.