CVE-2025-66204 Details
Description
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5.
A vulnerability exists in WBCE CMS version 1.6.4, allowing attackers to bypass brute-force protection on the login mechanism. The application fully trusts the 'X-Forwarded-For' header without validation, enabling attackers to reset the login attempt counter indefinitely. This flaw allows for unlimited password guessing attempts, effectively circumventing all brute-force defenses.
Users can upgrade to WBCE CMS version 1.6.5, which addresses this vulnerability by implementing a captcha on the login process and delaying login responses to make brute-force attacks more difficult.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5 | [email protected] | Patch |
| https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 | [email protected] | Release Notes |
| https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wbce wbce cms | < 1.6.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Dec 9, 2025 | CVE Modified | CISA-ADP |
| Dec 9, 2025 | New CVE Received | [email protected] |