WBCE CMS v1.5.4 - Cross Site Scripting (Stored)

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. id: CVE-2022-45038 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...

WBCE-v1.6.3-Authenticated-RCE

WBCE CMS printerror$MESSAGE'GENERICINVALIDADDONFILE'; Une fois que le module passe cette vérification en tant qu'« Add-On valide », tous les scripts install.php sont automatiquement exécutés sur le serveur. Cet exploit utilise simplement un php reverse shell comme payload PHP. Démonstration YouTu...

WBCE CMS v1.5.4 - Remote Code Execution

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. id: CVE-2022-46020 info: name: WBCE CMS v1.5.4 - Remote Code Execution author: theamanrawat severity: critical description: | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. impact: | Successful...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS XSS stocké v1.6.1 Auteur : Sergio Description : WBCE CMS 1.6.1 est affecté par une vulnérabilité de script intersite stocké XSS qui permet aux attaquants d'exécuter du code arbitraire via un payload conçu dans le paramètre Page d'introduction du menu Pages. Le payload sera exécuté sur la...

CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE ثغرة رفع الملفات XSS - WBCE v1.6.1 المؤلف: Sergio الوصف: ثغرة رفع ملفات في WBCE v.1.6.1 تسمح لمهاجم محلي برفع ملف PDF يحتوي على XSS مخفي. نواقل الهجوم: ثغرة في تعقيم رفع ملفات Media تسمح لك برفع ملف PDF يحتوي على XSS مخفي. POC: عند تسجيل الدخول إلى اللوحة، سننتقل إلى قسم "Media" من القائمة...

CVE-2025-65950

CVE-2025-65950 : WBCE CMS est vulnérable à une injection SQL aveugle basée sur le temps via le paramètre groups Vue d'ensemble Champ| Détails ---|--- ID CVE| CVE-2025-65950 Gravité| CRITIQUE Avis| Voir l'avis Découvert par| Lukasz Rybak Produits concernés WBCE/WBCECMS Détails Résumé Une...

CVE-2025-66204

CVE-2025-66204: WBCE CMS يسمح بتجاوز حماية القوة الغاشمة باستخدام رأس X-Forwarded-For نظرة عامة الحقل| التفاصيل ---|--- معرف CVE| CVE-2025-66204 الخطورة| MEDIUM الإشعار| عرض الإشعار اكتشفه| Lukasz Rybak المنتجات المتأثرة WBCE/WBCECMS التفاصيل الملخص يوجد تجاوز لحماية القوة الغاشمة في WBCE CMS...

CVE-2025-65094

CVE-2025-65094: WBCE CMS عرضة لتصعيد الامتيازات عبر التلاعب بمعرف المجموعة IDOR نظرة عامة الحقل| التفاصيل ---|--- معرف CVE| CVE-2025-65094 الخطورة| HIGH التنبيه| عرض التنبيه تم اكتشافه بواسطة| Lukasz Rybak المنتجات المتأثرة WBCE/WBCECMS التفاصيل الملخص يمكن للمستخدم ذي الامتيازات المنخفضة في WBCE...

📄 WBCE CMS 1.6.4 Brute Force

WBCE CMS versions 1.6.4 suffers from a brute force protection bypass vulnerability. CVE-2025-66204: WBCE CMS allows brute-force protection bypass using X-Forwarded-For header Overview | Field | Details | |---|---| | CVE ID | CVE-2025-66204 | | Severity | MEDIUM | | Advisory | View Advisory | |...

📄 WBCE CMS Privilege Escalation / Insecure Direct Object Reference

WBCE CMS versions prior to 1.6.4 suffers from insecure direct object reference and privilege escalation vulnerabilities. CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation IDOR Overview | Field | Details | |---|---| | CVE ID | CVE-2025-65094 | | Severity | HI...

📄 WBCE CMS 1.6.4 SQL Injection

WBCE CMS versions 1.6.4 and below suffer from a remote time-bsed SQL injection vulnerability via the groups parameter. CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview | Field | Details | |---|---| | CVE ID | CVE-2025-65950 | | Severity |...

Exploit for Improper Authorization in Wbce Wbce_Cms

CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation...

Exploit for SQL Injection in Wbce Wbce_Cms

CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL...

WBCE CMS 1.6.4 - Remote Code Execution

Exploit Title: WBCE CMS 1.6.4 - Remote Code Execution Date: 2024-10-26 Exploit Author: Chokri Hammedi Vendor Homepage: https://wbce.org/ Software Link: https://github.com/WBCE/WBCECMS/releases/tag/v1.6.4 Version: 1.6.4 Tested on: Linux Debian/Parrot OS Vulnerability Description WBCE CMS version...

CVE-2022-50936

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936

WBCE CMS 1.5.2 is affected by an authenticated remote code execution vulnerability in the admin panel’s droplet upload functionality. Authenticated attackers can craft a zip payload to upload a malicious droplet, enabling arbitrary PHP code execution on the server. This aligns with multiple sourc...

CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...

CVE-2022-50936: Unrestricted Upload of File with Dangerous Type

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by...