WBCE CMS.

WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

• WBCE CMS
• Unrestricted file upload

WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability

• WBCE CMS
• Open redirect

WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload

• WBCE CMS
• Unrestricted file upload

WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload

• WBCE CMS
• Unrestricted file upload

WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter

• WBCE_CMS
• SQL injection

WBCE CMS has Weak Random Number Generator in Password Generation Function

• WBCE_CMS
• Weak cryptography or TLS
• CWE-331

WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

• WBCE_CMS
• Authentication bypass
• CWE-693

WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

• WBCE_CMS
• Privilege escalation
• Broken access control

WBCE CMS Header class.login.php increase_attempts excessive authentication

• WBCE CMS
• Denial of service