WBCE CMS vulnerabilities

40 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Latest WBCE CMS vulnerabilities

CVE-2022-50936 — WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated) (CVSS 8.8)
CVE-2023-53910 — WBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Content (CVSS 5.4)
CVE-2023-53909 — WBCE CMS 1.6.1 SVG File Content Cross-Site Scripting (CVSS 5.4)
CVE-2023-53901 — WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability (CVSS 6.1)
CVE-2025-34506 — WBCE CMS 1.6.3 Authenticated Remote Code Execution via Module Upload (CVSS 8.8)
CVE-2024-58283 — WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload (CVSS 8.8)
CVE-2025-65950 — WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter (CVSS 8.8)
CVE-2025-67504 — WBCE CMS has Weak Random Number Generator in Password Generation Function (CVSS 9.8)
CVE-2025-66204 — WBCE CMS allows brute-force protection bypass using X-Forwarded-For header (CVSS 8.1)
CVE-2025-65094 — WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR) (CVSS 8.8)
CVE-2023-39796 — (CVSS 9.8)
CVE-2023-46054 — (CVSS 5.4)
CVE-2023-43871 — (CVSS 5.4)
CVE-2023-38947 — (CVSS 7.2)
CVE-2023-29855 — (CVSS 7.2)
CVE-2022-46020 — (CVSS 9.8)
CVE-2022-45040 — (CVSS 5.4)
CVE-2022-45039 — (CVSS 7.2)
CVE-2022-45038 — (CVSS 5.4)
CVE-2022-45037 — (CVSS 5.4)
CVE-2022-45036 — (CVSS 5.4)
CVE-2022-45017 — (CVSS 4.8)
CVE-2022-45016 — (CVSS 4.8)
CVE-2022-45015 — (CVSS 4.8)
CVE-2022-45014 — (CVSS 4.8)