CVE-2025-67504
Published: 09 December 2025
Summary
CVE-2025-67504 is a critical-severity Insufficient Entropy (CWE-331) vulnerability in Wbce Wbce Cms. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201876
Vulnerability details
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account…
more
compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Approved key-establishment methods mandate sufficient entropy during key generation, eliminating entropy-starved keys.
Security associations share details on cryptographically weak PRNGs, helping avoid their implementation in security-critical functions.