GCVE - cpe:2.3:a:wbce:wbce_cms:1.6.1:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wbce:wbce_cms:1.6.1:-:*:*:*:*:*:*

part: a version: 1.6.1 update: -

Vendor	Wbce (`25505168-e398-58ca-86f3-dca0bfe1c6dd`)
Product	Wbce Cms (`be0de863-786f-5eb8-be3f-b5bc8eef8102`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wbce/wbce_cms`	purl2cpe	2026-06-01 10:11:03.092520

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-53910`	vulnerable	2026-06-08 06:19:39.992951	WBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Content MEDIUM (5.4) WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script content in the content parameter to execute JavaScript when users view the affected page. Published: 2025-12-17T22:44:47.417Z Updated: 2026-04-07T14:07:31.547Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51484 https://wbce-cms.org/ https://www.vulncheck.com/advisories/wbce-cms-stored-cross-site-scripting-via-page-content	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53909`	vulnerable	2026-06-08 06:19:39.992505	WBCE CMS 1.6.1 SVG File Content Cross-Site Scripting MEDIUM (5.4) WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the /wbce/modules/elfinder/ef/php/connector.wbce.php endpoint and execute JavaScript when victims access the uploaded file. Published: 2025-12-17T22:44:46.920Z Updated: 2026-05-24T01:37:36.279Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51484 https://wbce-cms.org/ https://www.vulncheck.com/advisories/wbce-cms-svg-file-content-cross-site-scripting	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-53901`	vulnerable	2026-06-08 06:19:39.971286	WBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability MEDIUM (5.4) WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can upload a crafted HTML file with CSS-based keylogging techniques to intercept password characters through background image requests. Published: 2025-12-16T17:03:48.025Z Updated: 2026-04-07T14:07:24.332Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51566 https://wbce-cms.org/ https://www.vulncheck.com/advisories/wbce-cms-cross-site-scripting-and-open-redirect-vulnerability	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-38947`	vulnerable	2026-06-08 06:09:35.604336	Details available An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file. Published: 2023-08-03T00:00:00.000Z Updated: 2024-08-02T17:54:39.540Z Open on db.gcve.eu Reference links https://gitee.com/CTF-hacker/pwn/issues/I7LH2N https://github.com/capture0x/WBCE_CMS https://packetstormsecurity.com/files/176018/WBCE-CMS-1.6.1-Shell-Upload.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.