high8.8
CVE-2025-34506
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules.
Impact
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wbce | Wbce Cms | through 1.6.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Swammers8/WBCE-v1.6.3-Authenticated-RCE
- https://github.com/WBCE/WBCE_CMS
- https://wbce-cms.org/
- https://www.exploit-db.com/exploits/52132
- https://www.vulncheck.com/advisories/wbce-cms-authenticated-remote-code-execution-via-module-upload
- https://youtu.be/Dhg5gRe9Dzs?si=-WQoiWU1yqvYNz1e