WBCE CMS v1.5.4 - Remote Code Execution

披露于 2022/12/21 · 更新于 2025/10/14

CVSS 评分9.8/ 10.0

EPSS 概率84.6%百分位 99.3%

漏洞描述

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 wbce_cms 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2023-39796 WBCE 1.6.0 - SQL Injection wbce_cms	严重	9.8	81.9%	PoCEXP	2023/08/07
CVE-2022-45038 WBCE CMS v1.5.4 - Cross Site Scripting (Stored) wbce_cms	中危	5.4	13.2%	PoCEXP	2022/11/26
CVE-2022-45037 WBCE CMS v1.5.4 - Cross Site Scripting (Stored) wbce_cms	中危	5.4	13.2%	PoCEXP	2022/11/26
CVE-2022-30073 WBCE CMS 1.5.2 - Cross-Site Scripting wbce_cms	中危	5.4	13.8%	PoCEXP	2022/05/18