PT-2026-2412 · Wbce Cms · Wbce Cms

Antonio Cuomo · Publicado 2026-01-13 · Atualizado 2026-01-20 · CVE-2022-50936

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WBCE CMS version 1.5.2

Description The software contains an authenticated remote code execution issue. Attackers can upload malicious droplets through the admin panel. Specifically, authenticated attackers can exploit the droplet upload functionality within the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload. The vulnerable functionality is related to the droplet upload process.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the droplet upload functionality in the admin panel.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2022-50936

Produtos afetados

Wbce Cms

Referências · 9

• 🔥 https://exploit-db.com/exploits/50707 · Exploit
• https://github.com/WBCE/WBCE_CMS · Nota
• https://twitter.com/CVEnew/status/2011383050387501498 · Publicação no Twitter
• https://vulncheck.com/advisories/wbce-cms-remote-code-execution-rce-authenticated · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-50936 · Nota de Segurança
• https://wbce.org · Nota
• https://wbce.org/de/downloads · Nota
• https://osv.dev/vulnerability/CVE-2022-50936 · Aviso do Fabricante
• https://t.me/cveNotify/149317 · Publicação no Telegram