CVE-2025-67504

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-11

Assigner: GitHub, Inc.

Description

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-09

Last Modified

2025-12-11

Generated

2026-07-06

AI Q&A

2025-12-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67504

EUVD

EUVD-2025-201876

Affected Vendors & Products

Vendor	Product	Version / Range
wbce	cms	1.6.4
wbce	wbce_cms	to 1.6.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-331	The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CWE-338	The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to user account compromise or privilege escalation if the predictable passwords are used for new accounts or password resets, potentially allowing unauthorized access to the system.

Executive Summary

This vulnerability exists in WBCE CMS versions 1.6.4 and below, where the function GenerateRandomPassword() uses PHP's rand() function to create passwords. Since rand() is not cryptographically secure, the generated passwords can be predicted or brute-forced, making it easier for attackers to compromise user accounts or escalate privileges.

Mitigation Strategies

Upgrade WBCE CMS to version 1.6.5 or later, as this version fixes the vulnerability related to the insecure use of PHP's rand() function in password generation. Avoid using affected versions (1.6.4 and below) for new accounts or password resets until upgraded.

Hi! I’m here to help you understand CVE-2025-67504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70