PT-2025-49779 · Wbce Cms · Wbce Cms

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-67504

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WBCE CMS versions 1.6.4 and below

Description WBCE CMS uses the GenerateRandomPassword() function to create passwords using PHP's rand(). The rand() function is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets.

Recommendations Update WBCE CMS to version 1.6.5.

Exploit

Fix

LPE

Weakness Enumeration

CWE-331

CWE-338

Related Identifiers

CVE-2025-67504

GHSA-76GJ-PMVX-JCC6

Affected Products

Wbce Cms

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67504.json · Exploit
• 🔥 https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 · Exploit
• https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-67504 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67504 · Vendor Advisory
• https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 · Note
• https://twitter.com/NCIIPC/status/1998351633730691317 · Twitter Post
• https://twitter.com/CveFindCom/status/1998432499748278634 · Twitter Post
• https://twitter.com/0dayPublishing/status/1998236235471417768 · Twitter Post
• https://cwe.mitre.org/data/definitions/338.html · Note
• https://twitter.com/CVEnew/status/1998355387658260871 · Twitter Post
• https://t.me/CVEtracker/39207 · Telegram Post