Vulnerability in Wbce Cms
CVE-2025-67504
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (41.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 41.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Wbce Cms — versions < 1.6.5
Weakness classification (CWE)
References
- github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 (Exploit, Vendor Advisory)
- github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6 (Patch)
- cwe.mitre.org/data/definitions/338.html (Technical Description)
- github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 (Release Notes)
Frequently asked questions
- What is CVE-2025-67504?
- CVE-2025-67504 is a critical-severity vulnerability in Wbce Cms, classified under Insufficient Entropy. CVSS score: 9.1/10. Published 2025-12-09.
- How severe is CVE-2025-67504?
- Critical severity. CVSS v3 base score is 9.1 out of 10.