Zero121

**Name of the Vulnerable Software and Affected Versions** Thecosy IceCMS versions up to 2.0.1 **Description** A critical vulnerability was found in Thecosy IceCMS, allowing remote attackers to manage user sessions. The manipulation affects unknown code and can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Thecosy IceCMS versions up to 2.0.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thecosy IceCMS versions up to 2.0.1 **Description** A vulnerability has been found in the User Data Handler component, leading to improper access controls. The attack may be initiated remotely. This issue affects some unknown processing of the component. **Recommendations** For Thecosy IceCMS versions up to 2.0.1, consider restricting access to the User Data Handler component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thecosy IceCMS version 2.0.1 **Description** A critical vulnerability was found in Thecosy IceCMS, affecting an unknown function of the file /article/DelectArticleById/ of the component Article Handler. This issue leads to permission problems and can be exploited remotely. **Recommendations** For Thecosy IceCMS version 2.0.1, consider disabling access to the /article/DelectArticleById/ endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thecosy IceCMS version 2.0.1 **Description** A vulnerability was found in the User Comment Handler component, affecting unknown code of the file /planet. The manipulation leads to cross site scripting. The attack can be initiated remotely. **Recommendations** For Thecosy IceCMS version 2.0.1, consider disabling the User Comment Handler component until a patch is available to prevent cross site scripting attacks. Restrict access to the /planet file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Thecosy IceCMS version 2.0.1 **Description** A vulnerability was found in the Comment Like Handler component, affecting the processing of the file /Websquare/likeClickComment/. This issue leads to improper enforcement of a single, unique action and can be initiated remotely. The complexity of an attack is rather high, and the exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. **Recommendations** For Thecosy IceCMS version 2.0.1, consider disabling the Comment Like Handler component or restricting access to the /Websquare/likeClickComment/ file until a patch is available. As a temporary workaround, avoid using the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.