wbce has 5 CVEs on record. The busiest recent month was December 2025 with 5. The median CVSS is 8.8 (high), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-65950High· 8.8WBCE CMS is a content management system61CVE-2025-66204High· 8.1WBCE CMS is a content management system57CVE-2025-67504Critical· 9.1WBCE CMS is a content management system50CVE-2025-34506High· 8.8WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules49CVE-2024-58283High· 8.8WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager49
wbce vulnerabilities
CVEs affecting wbce, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2025-34506High· 8.8WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell co…
CVE-2024-58283High· 8.8WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinde…
CVE-2025-65950High· 8.8PoCWBCE CMS is a content management system
WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a ful…
CVE-2025-67504Critical· 9.1WBCE CMS is a content management system
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or br…
CVE-2025-66204High· 8.1PoCWBCE CMS is a content management system
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing atte…