Wbce vulnerabilities
We track 11 vulnerabilities in Wbce products across 2 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on January 13, 2026.
Latest Wbce vulnerabilities
- 8.8 High severity
WBCE CMS: Unrestricted Upload of File with Dangerous Type
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create a
- 8.8 High severity
WBCE CMS: Unrestricted Upload of File with Dangerous Type
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote syste
- 8.8 High severity
WBCE CMS: Unrestricted Upload of File with Dangerous Type
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a
- 8.8 High severity
WBCE_CMS: Improper Neutralization of Special Elements used in an SQL Command
WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise,
- 9.8 Critical severity
WBCE_CMS: Insufficient Entropy
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can le
- 8.1 High severity
WBCE_CMS: Improper Restriction of Excessive Authentication Attempts
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypas
- 8.8 High severity
WBCE_CMS: Incorrect Privilege Assignment
WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to
- 9.8 Critical severity
Wbce CMS: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.
- 7.2 High severity
wbce_cms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
- 7.2 High severity
Wbce CMS: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
- 7.5 High severity
CMS: Improper Restriction of Excessive Authentication Attempts
A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-