PT-2025-49680 · Wbce Cms · Wbce Cms

Published 2025-12-08 · Updated 2025-12-22 · CVE-2025-66204

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WBCE CMS versions prior to 1.6.5

Description WBCE CMS is a content management system susceptible to a brute-force protection bypass. An attacker can reset the attempt counter by manipulating the X-Forwarded-For header with each request, enabling unlimited password guessing attempts. The application trusts the X-Forwarded-For header without validation or restriction. The vulnerable parameter is X-Forwarded-For.

Recommendations Update to WBCE CMS version 1.6.5 or later.

Exploit

Fix

Protection Mechanism Failure

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-693

CWE-307

Related Identifiers

CVE-2025-66204

GHSA-F676-F375-M7MW

Affected Products

Wbce Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66204.json · Exploit
• 🔥 https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw · Exploit
• https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5 · Patch
• https://osv.dev/vulnerability/CVE-2025-66204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66204 · Security Note
• https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 · Note
• https://t.me/CVEtracker/39178 · Telegram Post
• https://twitter.com/cracbot/status/2000158869390286955 · Twitter Post
• https://twitter.com/CVEnew/status/2003234001205776840 · Twitter Post
• https://t.me/cveNotify/145221 · Telegram Post
• https://twitter.com/dailycve/status/1999167253963530393 · Twitter Post