CVE-2025-34506

High · 8.8

CVSS

8.8

EPSS

0.9%

Published

Dec 11, 2025

CISA due date

—

The record

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.

Affected packages

Ecosystem	Package	Introduced	Fixed