Kritik CVSS 9.8 PoC var
CVE-2025-67504: Wbce Cms: güvenlik açığı
Açıklama (NVD)
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
Özet bilgiler
- Ürün
- Wbce Wbce Cms
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,52 (yüzdelik 44)
- CWE
- CWE-331
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| wbce-wbce-cms | — | — | 1.6.5 |