Vulnerability in Wbce Wbce_cms
CVE-2025-67504
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brut…
EPSS: 0.004 (35.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Wbce Wbce_cms — versions < 1.6.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2025-67504?
- CVE-2025-67504 is a critical-severity vulnerability in Wbce Wbce_cms, classified under Insufficient Entropy. CVSS score: 9.1/10. Published 2025-12-09.
- How severe is CVE-2025-67504?
- Critical severity. CVSS v3 base score is 9.1 out of 10.