Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2025-34506WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload
High 8.6
In plain English
A high-severity unrestricted file upload in WBCE CMS from WBCE. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.9%top 39.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-52132 exploit
- WBCE CMS Homepage product
- WBCE CMS GitHub Repository product
- YouTube Demonstration product
- Swammers8 GitHub Repository technical-description
- VulnCheck Advisory: WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload third-party-advisory