Skip to content
Noroxi

WBCE records

40 published records for vendor wbce.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
10%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 22
  6. 23
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

40 records
  • CVE-2022-46020
    51Plan

    WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    wbce · wbce cmsDec 20, 2022

  • CVE-2021-3817
    51Plan

    SQL Injection in wbce/wbce_cms

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    wbce · wbce cmsDec 9, 2021

  • CVE-2023-39796
    41Plan

    SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    wbce · wbce cmsNov 10, 2023

  • CVE-2025-67504
    39Monitor

    WBCE CMS has Weak Random Number Generator in Password Generation Function

    CriticalCVSS 9.8No exploitEPSS 0%

    wbce · wbce cmsDec 9, 2025

  • CVE-2025-65950
    37Monitor

    WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    wbce · wbce cmsDec 10, 2025

  • CVE-2017-2119
    35Monitor

    Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.

    HighCVSS 8.6No exploitEPSS 3%

    wbce · wbce cmsApr 28, 2017

  • CVE-2022-50936
    34Monitor

    WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

    HighCVSS 8.7No exploitEPSS 0%

    wbce · wbce cmsJan 13, 2026

  • CVE-2025-34506
    34Monitor

    WBCE CMS 1.6.3 Authenticated Remote Code Execution via Module Upload

    HighCVSS 8.6No exploitEPSS 0%

    wbce · wbce cmsDec 11, 2025

  • CVE-2024-58283
    34Monitor

    WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload

    HighCVSS 8.7No exploitEPSS 0%

    wbce · wbce cmsDec 10, 2025

  • CVE-2025-65094
    34Monitor

    WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

    HighCVSS 8.7Proof of conceptEPSS 0%

    wbce · wbce cmsNov 19, 2025

  • CVE-2022-25101
    31Monitor

    A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file

    HighCVSS 7.8No exploitEPSS 1%

    wbce · wbce cmsFeb 24, 2022

  • CVE-2022-25099
    31Monitor

    A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.

    HighCVSS 7.8No exploitEPSS 1%

    wbce · wbce cmsFeb 24, 2022

  • CVE-2022-4006
    30Monitor

    WBCE CMS Header class.login.php increase_attempts excessive authentication

    HighCVSS 7.5No exploitEPSS 0%

    wbce · wbce cmsNov 15, 2022

  • CVE-2019-17575
    28Monitor

    A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier.

    HighCVSS 7.2No exploitEPSS 1%

    wbce · wbce cmsOct 14, 2019

  • CVE-2017-2120
    28Monitor

    SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands v

    HighCVSS 7.2No exploitEPSS 1%

    wbce · wbce cmsApr 28, 2017

  • CVE-2023-29855
    28Monitor

    WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.

    HighCVSS 7.2No exploitEPSS 1%

    wbce · wbce cmsApr 18, 2023

  • CVE-2022-45039
    28Monitor

    An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a cra

    HighCVSS 7.2No exploitEPSS 1%

    wbce · wbce cmsNov 25, 2022

  • CVE-2023-38947
    28Monitor

    An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code

    HighCVSS 7.2No exploitEPSS 0%

    wbce · wbce cmsAug 3, 2023

  • CVE-2023-53901
    28Monitor

    WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wbce · wbce cmsDec 16, 2025

  • CVE-2025-66204
    25Monitor

    WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

    MediumCVSS 6.3Proof of conceptEPSS 0%

    wbce · wbce cmsDec 9, 2025

  • CVE-2017-2118
    24Monitor

    Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspeci

    MediumCVSS 6.1No exploitEPSS 1%

    wbce · wbce cmsApr 28, 2017

  • CVE-2022-28477
    24Monitor

    WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 6.1No exploitEPSS 0%

    wbce · wbce cmsApr 28, 2022

  • CVE-2022-30073
    21Monitor

    WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.

    MediumCVSS 5.4Proof of conceptEPSS 1%

    wbce · wbce cmsMay 17, 2022

  • CVE-2022-45037
    21Monitor

    A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or

    MediumCVSS 5.4Proof of conceptEPSS 1%

    wbce · wbce cmsNov 25, 2022

  • CVE-2022-45038
    21Monitor

    A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts

    MediumCVSS 5.4Proof of conceptEPSS 1%

    wbce · wbce cmsNov 25, 2022