CRITICAL🇵🇱 Wersja polska

CVE-2023-39796

CVSS 9.8v3.1pub. 2023-11-10upd. 2024-11-21

SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Wbce Cms

    APP
    Wbce
    1.6.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCESQLiAuth Bypass
CWE
References

Related vulnerabilities

CVE-2025-65950CRITICAL9.4PL ✓ten sam produkt

SQL Injection w WBCE CMS — nieautoryzowany dostęp do bazy danych

CVE-2025-67504CRITICAL9.1PL ✓ten sam produkt

WBCE CMS: słabe generowanie haseł umożliwia privilege escalation

CVE-2022-46020CRITICAL9.8ten sam produkt

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.

CVE-2021-3817CRITICAL9.8ten sam produkt

wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

CVE-2022-50936HIGH8.7ten sam produkt

WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to ...