We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2024-58283

CVE-2024-58283

PHP

Severity: HIGH
CVSS: 8.8CVSS
Published: 2025-12-10
Last modified: 2025-12-16
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.

References

https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip
https://wbce-cms.org/
https://www.exploit-db.com/exploits/52039
https://www.vulncheck.com/advisories/wbce-cms-remote-code-execution-via-elfinder-file-upload

Summary

Description

References