CVE-2025-65094
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In WBCE CMS prior to version 1.6.4, a low-privileged user can escalate privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. Missing server-side validation allows attackers to overwrite their group membership and obtain full administrative access.
Risk Assessment
An attacker could completely compromise the CMS by gaining administrative privileges. This leads to system compromise and potential data leakage.
Recommendation
Update WBCE CMS to version 1.6.4 or later. Conduct an audit of user privileges.
Other vulnerabilities in WBCE CMS
See all- CVE-2022-50936High
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability. Authenticated attackers can upload malicious droplets via the admin panel, exploiting the droplet upload functionality to execute arbitrary PHP code through a crafted zip file.
- CVE-2017-2120High
CVE-2017-2120 describes an SQL injection vulnerability in WBCE CMS version 1.1.10 and earlier. It allows an attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
- CVE-2017-2119High
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
- CVE-2025-67504Critical
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
- CVE-2025-34506High
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
- CVE-2024-58283High
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
- CVE-2025-65950High
WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. The vulnerability exists in the admin/users/save.php script, which improperly processes the groups[] parameter sent from the user edit form.
- CVE-2025-66204High
WBCE CMS version 1.6.4 contains a brute-force protection bypass where an attacker can reset the counter by modifying X-Forwarded-For, allowing unlimited password guessing. Fixed in 1.6.5.
Original NVD description (English source)
WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, but server-side validation is missing, allowing attackers to overwrite their group membership and obtain full administrative access. This results in a complete compromise of the CMS. This issue has been patched in version 1.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS