This page lists publicly disclosed CVE vulnerabilities affecting wbce wbce_cms (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2022-50936 | WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload. | [email protected] | 8.7 | 1.15% | 2026-01-13 | 2026-01-20 |
| CVE-2023-53910 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script content in the content parameter to execute JavaScript when users view the affected page. | [email protected] | 5.1 | 0.03% | 2025-12-17 | 2025-12-27 |
| CVE-2023-53909 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the /wbce/modules/elfinder/ef/php/connector.wbce.php endpoint and execute JavaScript when victims access the uploaded file. | [email protected] | 5.1 | 0.03% | 2025-12-17 | 2025-12-27 |
| CVE-2023-53901 | WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image requests. | [email protected] | 7.1 | 0.03% | 2025-12-16 | 2025-12-30 |
| CVE-2025-34506 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed. | [email protected] | 8.6 | 0.95% | 2025-12-11 | 2025-12-15 |
| CVE-2024-58283 | WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter. | [email protected] | 8.7 | 0.57% | 2025-12-10 | 2025-12-16 |
| CVE-2025-65950 | WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls. The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user e | [email protected] | 9.4 | 0.06% | 2025-12-10 | 2025-12-16 |
| CVE-2025-67504 | WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5. | [email protected] | 9.1 | 0.06% | 2025-12-09 | 2025-12-11 |
| CVE-2025-66204 | WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5. | [email protected] | 6.3 | 0.05% | 2025-12-09 | 2025-12-11 |
| CVE-2025-65094 | WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, but server-side validation is missing, allowing attackers to overwrite their group membership and obtain full administrative access. This results in a complete compromise of the CMS. This issue has been | [email protected] | 8.7 | 0.05% | 2025-11-19 | 2025-12-15 |
| CVE-2023-39796 | SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter. | [email protected] | 9.8 | 70.99% | 2023-11-10 | 2024-11-21 |
| CVE-2023-46054 | Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component. | [email protected] | 5.4 | 0.11% | 2023-10-21 | 2024-11-21 |
| CVE-2023-43871 | A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). | [email protected] | 5.4 | 0.17% | 2023-09-28 | 2024-11-21 |
| CVE-2023-38947 | An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file. | [email protected] | 7.2 | 0.16% | 2023-08-03 | 2024-11-21 |
| CVE-2023-29855 | WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php. | [email protected] | 7.2 | 1.19% | 2023-04-18 | 2025-02-06 |
| CVE-2022-46020 | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. | [email protected] | 9.8 | 87.45% | 2022-12-20 | 2025-04-17 |
| CVE-2022-45040 | A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field. | [email protected] | 5.4 | 0.21% | 2022-11-25 | 2025-04-25 |
| CVE-2022-45039 | An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file. | [email protected] | 7.2 | 0.48% | 2022-11-25 | 2025-04-25 |
| CVE-2022-45038 | A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. | [email protected] | 5.4 | 3.04% | 2022-11-25 | 2025-04-25 |
| CVE-2022-45037 | A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. | [email protected] | 5.4 | 3.04% | 2022-11-25 | 2025-04-25 |