CVE-2024-58283High· 8.8▾ TwilightWBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinde…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
wbce_cms = 1.6.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-34506High· 8.8WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules
CVE-2025-67504Critical· 9.1WBCE CMS is a content management system
CVE-2025-66204High· 8.1WBCE CMS is a content management system
CVE-2025-65950High· 8.8WBCE CMS is a content management system
CVE-2025-14199Medium· 6.3A flaw has been found in Verysync 微力同步 up to 2.21.3
CVE-2025-11347High· 7.3A vulnerability was found in code-projects Student Crud Operation up to 3.3