Wbce CMS
by Wbce
Source repositories
CVEs (40)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-46020 | Cri | 0.67 | 9.8 | 0.39 | Dec 20, 2022 | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. | ||
| CVE-2023-39796 | Cri | 0.64 | 9.8 | 0.06 | Nov 10, 2023 | SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter. | ||
| CVE-2022-50936 | Hig | 0.57 | 8.8 | 0.01 | Jan 13, 2026 | WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute… | ||
| CVE-2025-34506 | Hig | 0.57 | 8.8 | 0.01 | Dec 11, 2025 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the… | ||
| CVE-2024-58283 | Hig | 0.57 | 8.8 | 0.01 | Dec 10, 2025 | WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and… | ||
| CVE-2017-2119 | Hig | 0.56 | 8.6 | 0.04 | Apr 28, 2017 | Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors. | ||
| CVE-2022-25101 | Hig | 0.51 | 7.8 | 0.01 | Feb 24, 2022 | A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file. | ||
| CVE-2022-25099 | Hig | 0.51 | 7.8 | 0.01 | Feb 24, 2022 | A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file. | ||
| CVE-2023-38947 | Hig | 0.47 | 7.2 | 0.01 | Aug 3, 2023 | An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file. | ||
| CVE-2023-29855 | Hig | 0.47 | 7.2 | 0.01 | Apr 18, 2023 | WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php. | ||
| CVE-2022-45039 | Hig | 0.47 | 7.2 | 0.01 | Nov 25, 2022 | An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file. | ||
| CVE-2019-17575 | Hig | 0.47 | 7.2 | 0.01 | Oct 14, 2019 | A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base… | ||
| CVE-2017-2120 | Hig | 0.47 | 7.2 | 0.01 | Apr 28, 2017 | SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors. | ||
| CVE-2022-28477 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2022 | WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2017-2118 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2017 | Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2023-53910 | Med | 0.35 | 5.4 | 0.00 | Dec 17, 2025 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with… | ||
| CVE-2023-53909 | Med | 0.35 | 5.4 | 0.00 | Dec 17, 2025 | WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the… | ||
| CVE-2023-53901 | Med | 0.35 | 5.4 | 0.00 | Dec 16, 2025 | WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image… | ||
| CVE-2023-46054 | Med | 0.35 | 5.4 | 0.00 | Oct 21, 2023 | Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component. | ||
| CVE-2023-43871 | Med | 0.35 | 5.4 | 0.00 | Sep 28, 2023 | A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). |
- risk 0.67cvss 9.8epss 0.39
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
- risk 0.64cvss 9.8epss 0.06
SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.
- risk 0.57cvss 8.8epss 0.01
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute…
- risk 0.57cvss 8.8epss 0.01
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the…
- risk 0.57cvss 8.8epss 0.01
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and…
- risk 0.56cvss 8.6epss 0.04
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
- risk 0.51cvss 7.8epss 0.01
A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
- risk 0.51cvss 7.8epss 0.01
A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
- risk 0.47cvss 7.2epss 0.01
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
- risk 0.47cvss 7.2epss 0.01
WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.
- risk 0.47cvss 7.2epss 0.01
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
- risk 0.47cvss 7.2epss 0.01
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base…
- risk 0.47cvss 7.2epss 0.01
SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.35cvss 5.4epss 0.00
WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with…
- risk 0.35cvss 5.4epss 0.00
WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the…
- risk 0.35cvss 5.4epss 0.00
WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image…
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component.
- risk 0.35cvss 5.4epss 0.00
A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
Page 1 of 2