CVE-2025-67504 Details
Description
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
A vulnerability exists in WBCE CMS versions through 1.6.4, where the password generation function 'GenerateRandomPassword()' uses PHP's 'rand()' function. This function is not cryptographically secure, allowing for the prediction or brute-forcing of password sequences. Such predictability can lead to the compromise of user accounts or unauthorized privilege escalation, especially if the weak passwords are used for new accounts or password resets.
Users can update to WBCE CMS version 1.6.5, where this vulnerability has been addressed by replacing 'rand()' with 'random_int()' for secure password generation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 | CISA-ADP | ExploitVendor Advisory |
| https://cwe.mitre.org/data/definitions/338.html | [email protected] | Technical Description |
| https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6 | [email protected] | Patch |
| https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 | [email protected] | Release Notes |
| https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wbce wbce cms | < 1.6.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Dec 9, 2025 | New CVE Received | [email protected] |
| Dec 9, 2025 | CVE Modified | CISA-ADP |