https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-50936.htmlhttps://patchthecve.com/cve/CVE-2022-50936.htmlWed, 17 Jun 2026 05:24:28 +0000HIGH 8.8: WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by craftinhttps://patchthecve.com/cve/CVE-2023-53910.htmlhttps://patchthecve.com/cve/CVE-2023-53910.htmlWed, 17 Jun 2026 06:46:18 +0000MEDIUM 5.4: WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script conhttps://patchthecve.com/cve/CVE-2023-53909.htmlhttps://patchthecve.com/cve/CVE-2023-53909.htmlWed, 17 Jun 2026 06:46:18 +0000MEDIUM 5.4: WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the /wbce/modules/elfinder/ef/php/connector.wbce.phttps://patchthecve.com/cve/CVE-2023-53901.htmlhttps://patchthecve.com/cve/CVE-2023-53901.htmlWed, 17 Jun 2026 06:46:17 +0000MEDIUM 5.4: WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image requests.https://patchthecve.com/cve/CVE-2025-34506.htmlhttps://patchthecve.com/cve/CVE-2025-34506.htmlThu, 29 Oct 2026 21:17:05 +0000HIGH 8.8: WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.https://patchthecve.com/cve/CVE-2024-58283.htmlhttps://patchthecve.com/cve/CVE-2024-58283.htmlSat, 26 Sep 2026 21:10:00 +0000HIGH 8.8: WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system https://patchthecve.com/cve/CVE-2025-65950.htmlhttps://patchthecve.com/cve/CVE-2025-65950.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 8.8: WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassinghttps://patchthecve.com/cve/CVE-2025-67504.htmlhttps://patchthecve.com/cve/CVE-2025-67504.htmlWed, 07 Oct 2026 20:10:01 +0000CRITICAL 9.1: WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilehttps://patchthecve.com/cve/CVE-2025-66204.htmlhttps://patchthecve.com/cve/CVE-2025-66204.htmlWed, 07 Oct 2026 20:10:01 +0000HIGH 8.1: WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The apphttps://patchthecve.com/cve/CVE-2025-65094.htmlhttps://patchthecve.com/cve/CVE-2025-65094.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.8: WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, but