CVE-2023-39796

high-risk

Published 2023-11-10

SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.

Do I need to act?

71.0% chance of exploitation in next 30 days

EPSS score — higher than 29% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Wbce Cms

Affected Vendors

Wbce

References (6)

Issue Tracking https://forum.wbce.org/viewtopic.php?pid=42046#p42046

Release Notes https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1

Third Party Advisory https://pastebin.com/PBw5AvGp

Issue Tracking https://forum.wbce.org/viewtopic.php?pid=42046#p42046

Release Notes https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1

Third Party Advisory https://pastebin.com/PBw5AvGp

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 19/34 · Moderate

Exposure 5/34 · Minimal