Critical severity9.1NVD Advisory· Published Dec 9, 2025· Updated Jun 17, 2026
CVE-2025-67504
CVE-2025-67504
Description
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6nvdPatch
- github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6nvdExploitVendor Advisory
- cwe.mitre.org/data/definitions/338.htmlnvdTechnical Description
- github.com/WBCE/WBCE_CMS/releases/tag/1.6.5nvdRelease Notes
News mentions
0No linked articles in our index yet.