CVE-2025-34506
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wbce | wbce_cms | to 1.6.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
WBCE CMS version 1.6.3 and prior has a vulnerability that allows authenticated administrators to upload malicious modules. Attackers can create a specially crafted ZIP module containing embedded PHP reverse shell code. When this malicious module is installed, it enables the attacker to execute remote code on the system, effectively gaining remote access.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrator access to execute arbitrary code remotely on the affected system. This can lead to full system compromise, unauthorized access to sensitive data, disruption of services, and potential use of the system as a foothold for further attacks.