WBCE CMS v1.5.4 - Cross Site Scripting (Stored)

A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. id: CVE-2022-45037 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...

WBCE 1.6.0 - SQL Injection

There is an sql injection vulnerability in "miniform module" which is a default module installed in the WBCE cms. It is an unauthenticated sqli so anyone could access it and takeover the whole database. In file "/modules/miniform/ajaxdeletemessage.php" there is no authentication check. On line 40...

CVE-2021-3817

wbcecms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...

WBCE 1.6.0 SQL Injection

Exploit Title: |Unauthenticated SQL injection in WBCE 1.6.0 Date: 15.11.2023 Exploit Author: young pope Vendor Homepage: https://github.com/WBCE/WBCECMS Software Link: https://github.com/WBCE/WBCECMS/archive/refs/tags/1.6.0.zip Version: 1.6.0 Tested on: Kali linux CVE : CVE-2023-39796 There is an...

CVE-2021-3817

wbcecms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...

CVE-2021-3817

wbcecms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...

CVE-2021-3817 SQL Injection in wbce/wbce_cms

wbcecms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...

CVE-2021-3817

CVE-2021-3817 affects WBCE CMS (wbce_cms) up to version 1.5.1, with a SQL injection in the password-reset page admin/login/forgot/index.php. The root cause is improper neutralization of special elements in SQL commands, enabling an attacker to bypass authentication and potentially take control (p...

SQL Injection in wbce/wbce_cms

Description Plaintext administrator password recovery vulnerability due to SQL injection in password reset page. admin/login/forgot/index.php lines 33-34: php $sSql = "SELECT FROM TPusers WHERE email = '" . $email . "'"; $rRow = $database-query$sSql; Due to poor email validation attacker can inje...