Read the docs

WBCE

Records40All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9

Exploited now

WBCE records in CISA KEV

No WBCE vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wbce Cms 40 records HIGH

Records

40 records in Wbce Cms · all components

TI-2024-38380 CVE-2024-58283 · GHSA-q35v-85f7-hfph

WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload

Priority HIGH 73

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00665 Published 2025-12-10 No fix listed CWE-434
TI-2021-02748 CVE-2021-3817 · GHSA-mjx8-7r29-w8cq

SQL Injection in wbce/wbce_cms

Priority HIGH 69

wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.38418 Published 2021-12-09 Fixed in 1.5.2 CWE-89
TI-2023-30184 CVE-2023-53901 · GHSA-5xp8-7cch-3599

WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability

Priority MEDIUM 64

WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.0027 Published 2025-12-16 No fix listed CWE-601
TI-2023-24714 CVE-2023-46054 · GHSA-4j6r-mf7f-44jq

Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote…

Priority MEDIUM 58

Cross Site Scripting (XSS) vulnerability in WBCE CMS v.1.6.1 and before allows a remote attacker to escalate privileges via a crafted script to the website_footer parameter in the admin/settings/save.php component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2023-10-21 No fix listed CWE-79
TI-2023-30193 CVE-2023-53910 · GHSA-cp7v-fv9w-75m3

WBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Content

Priority MEDIUM 56

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00325 Published 2025-12-17 No fix listed CWE-79
TI-2023-30192 CVE-2023-53909 · GHSA-j68f-qx6g-877w

WBCE CMS 1.6.1 SVG File Content Cross-Site Scripting

Priority MEDIUM 56

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00325 Published 2025-12-17 No fix listed CWE-79
TI-2017-01424 CVE-2017-2119 · GHSA-xchx-x59p-8hvh

Path traversal in WBCE CMS

Priority MEDIUM 43

Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.0351 Published 2017-04-28 No fix listed CWE-22
TI-2022-26388 CVE-2022-50936 · GHSA-4hp3-72w5-pmq7

WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)

Priority MEDIUM 41

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00933 Published 2026-01-13 No fix listed CWE-434
TI-2017-01425 CVE-2017-2120 · GHSA-32rq-3rm7-fq3r

SQL injection in WBCE CMS

Priority LOW 34

SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01294 Published 2017-04-28 No fix listed CWE-89
TI-2017-01423 CVE-2017-2118 · GHSA-f9c2-gpv4-366g

Cross-site scripting in WBCE CMS

Priority LOW 30

Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01209 Published 2017-04-28 No fix listed CWE-79
Load more
Open these records in search →