CVE-2024-58283
WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 10, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 10, 2025
Description
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
WBCE CMSwbce |
|
References
- ExploitDB-52039exploit
- WBCE CMS Homepageproduct
- WBCE CMS GitHub Repositoryproduct
- VulnCheck Advisory: WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.