CVE-2025-67504

CRITICAL9.1

WBCE CMS has Weak Random Number Generator in Password Generation Function

Published Dec 9, 2025

Modified 2 months ago

Details

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

References

WEB

https://cwe.mitre.org/data/definitions/338.html

WEB

https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6

WEB

https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5

DETECTION

https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-67504

CVSS Analysis