CVE-2025-67504
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-11

Assigner: GitHub, Inc.

Description
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-09
Last Modified
2025-12-11
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-67504
EUVD
EUVD-2025-201876
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wbce cms 1.6.4
wbce wbce_cms to 1.6.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-331 The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in WBCE CMS versions 1.6.4 and below, where the function GenerateRandomPassword() uses PHP's rand() function to create passwords. Since rand() is not cryptographically secure, the generated passwords can be predicted or brute-forced, making it easier for attackers to compromise user accounts or escalate privileges.

Mitigation Strategies

Upgrade WBCE CMS to version 1.6.5 or later, as this version fixes the vulnerability related to the insecure use of PHP's rand() function in password generation. Avoid using affected versions (1.6.4 and below) for new accounts or password resets until upgraded.

Impact Analysis

The vulnerability can lead to user account compromise or privilege escalation if the predictable passwords are used for new accounts or password resets, potentially allowing unauthorized access to the system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-67504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart