Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M

CVE-2025-67504WBCE CMS has Weak Random Number Generator in Password Generation Function

Critical 9.1

In plain English

A critical-severity security flaw in WBCE_CMS from WBCE. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

Affected products (as reported)

Vendor	Product	Versions
WBCE	WBCE_CMS	< 1.6.5

Weakness: CWE-331, CWE-338 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 x_refsource_CONFIRM
https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6 x_refsource_MISC
https://cwe.mitre.org/data/definitions/338.html x_refsource_MISC
https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 x_refsource_MISC