CVE-2025-66204

🗓️ 08 Dec 2025 23:50:58Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 17 Views🌐 WEB

WBCE CMS 1.6.4 permits unlimited brute-force attempts via X-Forwarded-For header; fixed in 1.6.5.

Reporter	Title	Published	Views	Family All 9
CNNVD	WBCE CMS 安全漏洞	9 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-66204 WBCE CMS allows brute-force protection bypass using X-Forwarded-For header	8 Dec 202523:50	–	cvelist
EUVD	EUVD-2025-201840	8 Dec 202523:50	–	euvd
NVD	CVE-2025-66204	9 Dec 202500:15	–	nvd
OSV	CVE-2025-66204 WBCE CMS allows brute-force protection bypass using X-Forwarded-For header	8 Dec 202523:50	–	osv
Packet Storm	📄 WBCE CMS 1.6.4 Brute Force	13 Apr 202600:00	–	packetstorm
Positive Technologies	PT-2025-49680	8 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-66204	10 Dec 202500:28	–	redhatcve
Vulnrichment	CVE-2025-66204 WBCE CMS allows brute-force protection bypass using X-Forwarded-For header	8 Dec 202523:50	–	vulnrichment

NVD

Vulners

Node

wbce wbce_cmsRange<1.6.5

[
  {
    "vendor": "WBCE",
    "product": "WBCE_CMS",
    "versions": [
      {
        "version": ">= 1.6.4, < 1.6.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5
github	www.github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw
github	www.github.com/WBCE/WBCE_CMS/releases/tag/1.6.5

Parameter	Position	Path	Description	CWE
X-Forwarded-For	header	wbce/admin/login/index.php	Brute-force protection bypass via unvalidated X-Forwarded-For header, allowing unlimited login attempts.	CWE-693, CWE-307

17 Jun 2026 09:56Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.18.1

CVSS 46.3

EPSS0.00402

SSVC