CVE-2022-50936
Published Jan 13, 2026WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated atta…
Vendor/product archive
wbce / wbce_cms CVEs
Beta · best-effort40 CVEs tagged to wbce / wbce_cms — 5 Critical, 13 High, 21 Medium, 1 Low, 0 Unrated.
CVE-2023-53910
Published Dec 17, 2025WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content t…
CVE-2023-53909
Published Dec 17, 2025WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the m…
CVE-2023-53901
Published Dec 16, 2025WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML…
CVE-2025-34506
Published Dec 11, 2025WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specia…
CVE-2024-58283
Published Dec 10, 2025WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attacker…
CVE-2025-65950
Published Dec 10, 2025WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to exe…
CVE-2025-67504
Published Dec 9, 2025WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically sec…
CVE-2025-66204
Published Dec 9, 2025WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For`…
CVE-2025-65094
Published Nov 19, 2025WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the gr…
CVE-2023-39796
Published Nov 10, 2023SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.
CVE-2023-46054
Published Oct 21, 2023Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the…
CVE-2023-43871
Published Sep 28, 2023A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
CVE-2023-38947
Published Aug 3, 2023An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2023-29855
Published Apr 18, 2023WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.
CVE-2022-46020
Published Dec 20, 2022WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
CVE-2022-45040
Published Nov 25, 2022A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj…
CVE-2022-45039
Published Nov 25, 2022An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-45038
Published Nov 25, 2022A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected…
CVE-2022-45037
Published Nov 25, 2022A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in…
CVE-2022-45036
Published Nov 25, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecte…
CVE-2022-45017
Published Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
CVE-2022-45016
Published Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecte…
CVE-2022-45015
Published Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecte…
CVE-2022-45014
Published Nov 21, 2022A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecte…
Showing 1-25 of 40 CVEsPage 1 of 2