CVE-2026-61523

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

CVE-2026-61524 WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

PT-2026-67455

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

SQL Injection and RCE in WebsiteBaker

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in WebsiteBaker CMS. A remote attacker will be able to read, write or modify arbitrary information in the database, gain complete control over the vulnerable web application and even the entire web server on which the...

CMS Websitebaker 2.8.3 SP3 Cross Site Scripting

Advisory: Reflecting XSS vulnerability in CMS Websitebaker v.2.8.3 SP3 Advisory ID: SROEADV-2015-03 Author: Steffen Rösemann Affected Software: CMS Websitebaker v.2.8.3 SP3 Vendor URL: http://www.websitebaker.org/de/home.php Vendor Status: Vendor did not respond CVE-ID: CVE-2015-0553 Tested with:...

WebsiteBaker CMS lack of sanitizing

WebsiteBaker CMS lack of sanitizing Discovered by: Nomenumbra Date: 6/4/2006 impact:moderate privilege escalation,possible defacement A user's display name isn't filtered at all, allowing them to insert any HTML of javascript code at will. Nomenumbra/0x4F4C...