Read the docs
TI-2025-41260 Aliases CVE-2025-67504

WBCE CMS has Weak Random Number Generator in Password Generation Function

Priority HIGH 82CWE-331Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00516 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WBCE_CMS (WBCE): 1.6.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WBCEWBCE_CMSbefore 1.6.51.6.5Patch availableCNA
  • WBCE_CMS VendorWBCE Affected before 1.6.5 Fixed in 1.6.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wbce:wbce_cms:*:*:*:*:*:*:*:*before 1.6.5VulnerableWBCE
  • cpe:2.3:a:wbce:wbce_cms:*:*:*:*:*:*:*:* Versions before 1.6.5 Vulnerable ·WBCE

Remediation

  • Fix · CNA WBCE_CMS (WBCE) Fixed in 1.6.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67504

References

Exploit 1

Patch 1

Other 2

  • TI-2022-22742 WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. CVSS 3.1CRITICAL 9.8
  • TI-2025-40518 WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter CVSS 4.0CRITICAL 9.4
  • TI-2025-40247 WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR) CVSS 4.0HIGH 8.7
  • TI-2024-38380 WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload CVSS 4.0HIGH 8.7
  • TI-2025-24531 WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload CVSS 4.0HIGH 8.6
  • TI-2021-02748 SQL Injection in wbce/wbce_cms CVSS 3.1CRITICAL 9.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences