CVE-2024-58283

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.65% chance of exploitation in the next 30 days, 49th percentile

Published

2025-12-10

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52039

References

• CVE Record
• NVD entry

Related

• CVE-2024-58282
• CVE-2024-58284
• CVE-2024-58281
• CVE-2024-58285
• CVE-2024-58280
• CVE-2024-58286