by Kastro
Paper/Archive/CVE-2025-67504

CVE-2025-67504

WBCE WBCE_CMS — WBCE CMS has Weak Random Number Generator in Password Generation Function

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.9.439 × 208.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

Affected

ProductAffectedFixed inSource
WBCE_CMS< 1.6.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6refgithub.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6refcwe.mitre.org/data/definitions/338.htmlrefgithub.com/WBCE/WBCE_CMS/releases/tag/1.6.5