Which versions of WBCE CMS are affected by CVE-2025-65950?

WBCE CMS versions 1.6.4 and earlier contain a critical SQL injection vulnerability that can lead to full database compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2025-65950?

Yes, a public proof-of-concept exploit is available for CVE-2025-65950. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-65950?

Within 24 hours, identify all instances of WBCE CMS running version 1.6.4 or earlier and apply the vendor-released patch 1.6.5 immediately; if patching cannot be completed within 24 hours, restrict access to the 'modify users' permission to only essential personnel and monitor for suspicious SQL activity. Within 7 days, verify that all instances have been patched to 1.6.5, audit logs for any attempted exploitation of the groups[] parameter, and review accounts with 'modify users' permission to enforce least privilege. Within 30 days, conduct a comprehensive security review of the WBCE CMS deployment, implement additional monitoring for SQL injection attempts, and consider a web application firewall rule to block malicious groups[] parameters.

WBCE CMS CVE-2025-65950

Q: What is the CVSS score of CVE-2025-65950?

CVE-2025-65950 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

SQL Injection (CWE-89)

2025-12-10 security-advisories@github.com

PHP SQLi Wbce Cms

9.4

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N/AC:L), but requires an authenticated user with user-modify rights (PR:L); SQLi enables full DB read/write (C/I/A:H) contained within the application (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 25, 2026 - 23:53 vuln.today

CVE Published

Dec 10, 2025 - 21:16 cve.org

CRITICAL 9.4

DescriptionCVE.org

WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls. The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user edit form. This issue is fixed in version 1.6.5.

AnalysisAI

SQL injection in WBCE CMS 1.6.4 and earlier lets an authenticated user who already holds the 'modify users' permission execute arbitrary SQL through the groups[] parameter handled by admin/users/save.php, enabling full database compromise and data exfiltration. Publicly available exploit code exists (detailed in the GitHub security advisory), and EPSS is low at 0.54% (43rd percentile), indicating limited observed exploitation activity. Vendor-released patch: 1.6.5. The assessed severity is high but access-gated, since exploitation requires an elevated administrative-tier account rather than anonymous access.

Technical ContextAI

WBCE CMS is a PHP-based content management system whose administrative user-management module writes profile changes through admin/users/save.php. The flaw is a classic CWE-89 SQL injection: the groups[] array submitted by the user edit form is not validated against the caller's own group membership or sanitized before being incorporated into a database query, allowing an attacker with user-modify rights to inject arbitrary SQL and pivot to full database control. The upstream commit 96046178f4c80cf16f7c224054dec7fdadddda7e addresses this by rebuilding group handling around $_SESSION['GROUPS_ID'] and enforcing authorization rules in save.php (unsetting group_id and aborting with a security error when a non-administrator attempts to assign groups outside their own membership) plus matching allow-list rendering logic in index.php and users.php. Authentication is required per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is not an anonymous or unauthenticated issue despite the network attack vector.

RemediationAI

Upgrade to WBCE CMS 1.6.5, which contains the vendor fix (commit 96046178f4c80cf16f7c224054dec7fdadddda7e) that enforces group-assignment authorization in admin/users/save.php and restricts group selection in index.php and users.php; the release is available at https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 and details are in the advisory at https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-934v-xhx9-j2f3. If immediate upgrading is not possible, restrict or temporarily revoke the 'modify users' permission from non-administrator roles so only fully trusted administrators can reach the user edit form and admin/users/save.php, accepting the operational trade-off that delegated user-management functionality is lost; additionally, audit and reduce the number of accounts holding user-modify rights and monitor database and web logs for anomalous queries or unexpected group_id/groups[] parameters sent to the admin user endpoints. Network-level blocking of admin paths offers limited value here because the injection is exercised by an already-authenticated administrative user.