CVE-2025-65950

CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview Field| Details ---|--- CVE ID| CVE-2025-65950 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A critical SQL Injection...

WBCE CMS v1.5.4 - Remote Code Execution

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. id: CVE-2022-46020 info: name: WBCE CMS v1.5.4 - Remote Code Execution author: theamanrawat severity: critical description: | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. impact: | Successful...

WBCE CMS v1.5.4 - Cross Site Scripting (Stored)

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. id: CVE-2022-45038 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...

WBCE-v1.6.3-Authenticated-RCE

WBCE CMS printerror$MESSAGE'GENERICINVALIDADDONFILE'; Una volta che il modulo supera questo controllo come "Add-On valido", qualsiasi script install.php viene automaticamente eseguito sul server. Questo exploit usa semplicemente una reverse shell PHP come payload PHP. Dimostrazione YouTube:...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 Autore: Sergio Descrizione: WBCE CMS 1.6.1 è affetto da una vulnerabilità di Cross-Site Scripting XSS persistente che consente agli attaccanti di eseguire codice arbitrario tramite un payload inserito nel parametro Intro Page del menu Pages. Il payload viene eseguito...

CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE XSS nel caricamento di file - WBCE v1.6.1 Autore: Sergio Descrizione: La vulnerabilità del caricamento di file in WBCE v.1.6.1 consente a un attaccante locale di caricare un file PDF con XSS nascosto. Vettori d'attacco: Una vulnerabilità nella sanitizzazione del caricamento di file dei Media...

CVE-2025-66204

CVE-2025-66204: WBCE CMS consente di bypassare la protezione brute-force utilizzando l'header X-Forwarded-For Panoramica Campo| Dettagli ---|--- ID CVE| CVE-2025-66204 Gravità| MEDIA Avviso| Visualizza avviso Scoperto da| Lukasz Rybak Prodotti Affetti WBCE/WBCECMS Dettagli Riepilogo Esiste un...

CVE-2025-65094

CVE-2025-65094: WBCE CMS è vulnerabile all'escalation dei privilegi tramite manipolazione dell'ID del gruppo IDOR Panoramica Campo| Dettagli ---|--- CVE ID| CVE-2025-65094 Gravità| ALTA Avviso| Visualizza avviso Scoperto da| Lukasz Rybak Prodotti interessati WBCE/WBCECMS Dettagli Riepilogo Un...

📄 WBCE CMS 1.6.4 Brute Force

WBCE CMS versions 1.6.4 suffers from a brute force protection bypass vulnerability. CVE-2025-66204: WBCE CMS allows brute-force protection bypass using X-Forwarded-For header Overview | Field | Details | |---|---| | CVE ID | CVE-2025-66204 | | Severity | MEDIUM | | Advisory | View Advisory | |...

📄 WBCE CMS Privilege Escalation / Insecure Direct Object Reference

WBCE CMS versions prior to 1.6.4 suffers from insecure direct object reference and privilege escalation vulnerabilities. CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation IDOR Overview | Field | Details | |---|---| | CVE ID | CVE-2025-65094 | | Severity | HI...

📄 WBCE CMS 1.6.4 SQL Injection

WBCE CMS versions 1.6.4 and below suffer from a remote time-bsed SQL injection vulnerability via the groups parameter. CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview | Field | Details | |---|---| | CVE ID | CVE-2025-65950 | | Severity |...

Exploit for Improper Authorization in Wbce Wbce_Cms

CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation...

Exploit for SQL Injection in Wbce Wbce_Cms

CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL...

WBCE CMS 1.6.4 - Remote Code Execution

Exploit Title: WBCE CMS 1.6.4 - Remote Code Execution Date: 2024-10-26 Exploit Author: Chokri Hammedi Vendor Homepage: https://wbce.org/ Software Link: https://github.com/WBCE/WBCECMS/releases/tag/v1.6.4 Version: 1.6.4 Tested on: Linux Debian/Parrot OS Vulnerability Description WBCE CMS version...

CVE-2022-50936

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936

WBCE CMS 1.5.2 is affected by an authenticated remote code execution vulnerability in the admin panel’s droplet upload functionality. Authenticated attackers can craft a zip payload to upload a malicious droplet, enabling arbitrary PHP code execution on the server. This aligns with multiple sourc...

CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936: Unrestricted Upload of File with Dangerous Type

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...