CVE-2025-66204

WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5	Patch
https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5	Release Notes
https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw	Exploit Vendor Advisory
https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wbce:wbce_cms:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) WBCE CMS es un sistema de gestión de contenidos. La versión 1.6.4 contiene una omisión de la protección contra fuerza bruta donde un atacante puede restablecer indefinidamente el contador modificando 'X-Forwarded-For' en cada solicitud, obteniendo intentos ilimitados para adivinar contraseñas, eludiendo eficazmente toda la protección contra fuerza bruta. La aplicación confía plenamente en el encabezado 'X-Forwarded-For' sin validarlo ni restringir su uso. Este problema se solucionó en la versión 1.6.5.

Information

Published : 2025-12-09 00:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-66204

Mitre link : CVE-2025-66204

CVE.ORG link : CVE-2025-66204

JSON object : View

Products Affected

wbce

wbce_cms

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-66204", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66204", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T14:18:12.951947Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WBCE", "product": "WBCE_CMS", "versions": [{"status": "affected", "version": ">= 1.6.4, < 1.6.5"}]}]}], "published": "2025-12-09T00:15:49.157", "references": [{"url": "https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mw", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-693"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5."}, {"lang": "es", "value": "WBCE CMS es un sistema de gesti\u00f3n de contenidos. La versi\u00f3n 1.6.4 contiene una omisi\u00f3n de la protecci\u00f3n contra fuerza bruta donde un atacante puede restablecer indefinidamente el contador modificando 'X-Forwarded-For' en cada solicitud, obteniendo intentos ilimitados para adivinar contrase\u00f1as, eludiendo eficazmente toda la protecci\u00f3n contra fuerza bruta. La aplicaci\u00f3n conf\u00eda plenamente en el encabezado 'X-Forwarded-For' sin validarlo ni restringir su uso. Este problema se solucion\u00f3 en la versi\u00f3n 1.6.5."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wbce:wbce_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D38CBB88-838C-4D43-B04B-0923D07D2F08", "versionEndExcluding": "1.6.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}