CVEvulnerability
CVE-2022-50936
8.7 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-01-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-434
Description
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.
Affected configurations
• wbce wbce cms 1.5.2
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://github.com/WBCE/WBCE_CMS Product
- https://wbce.org/ Product
- https://wbce.org/de/downloads/ Product
- https://www.exploit-db.com/exploits/50707 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/wbce-cms-remote-code-execution-rce-authenticated Third Party Advisory