CVE-2024-58283

8.8 HIGH
Published: December 10, 2025 Modified: December 16, 2025
View on NVD

Description

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip
Source: disclosure@vulncheck.com
Product
https://wbce-cms.org/
Source: disclosure@vulncheck.com
Product
https://www.exploit-db.com/exploits/52039
Source: disclosure@vulncheck.com
Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/wbce-cms-remote-code-execution-via-elfinder-file-upload
Source: disclosure@vulncheck.com
Third Party Advisory
https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Product

5 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.8 / 10.0
EPSS (Exploit Probability)
0.5%
67th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-434

Affected Vendors

wbce

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3