What’s Vulnerable › Vulnerabilities

CVE-2022-50936: WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-434

Description

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.

Affected products

• WBCE CMS: 1.5.2

References

• https://github.com/WBCE/WBCE_CMS
• https://wbce.org/
• https://wbce.org/de/downloads/
• https://www.exploit-db.com/exploits/50707
• https://www.vulncheck.com/advisories/wbce-cms-remote-code-execution-rce-authenticated

Get alerted when CVE-2022-50936 or the next vulnerability affects your stack