CVE-2025-34506 HIGH

CVE-2025-34506: WBCE CMS 1.6.3 Authenticated Remote Code Execution via Module Upload

Vendor Wbce
Product WBCE CMS
Weakness CWE-434 · Unrestricted file upload
Published December 11, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.

Key dates

02Disclosure timeline

December 11, 2025 CVE published
April 7, 2026 Record updated