{"id":"CVE-2025-67504","aliases":["EUVD-2025-201876","GHSA-76gj-pmvx-jcc6"],"status":"published","title":"WBCE CMS has Weak Random Number Generator in Password Generation Function","description":"WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00554,"percentile":0.46499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-331","CWE-338"],"published":"2025-12-09T03:31:17Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"wbce","product":"wbce_cms"}],"references":[{"url":"https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://cwe.mitre.org/data/definitions/338.html","tags":["x_refsource_MISC","Technical Description","web"]},{"url":"https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67504.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67504","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-67504","title":"WBCE CMS has Weak Random Number Generator in Password Generation Function","description":"WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.","status":"published","published":"2025-12-09T03:31:17.723Z","modified":"2025-12-09T15:10:35.359Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-331","CWE-338"],"updated_at":"2026-11-02T14:32:52.21763Z"}],"euvd":[{"id":"EUVD-2025-201876","description":"WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.","status":"published","published":"2025-12-09T03:31:17Z","modified":"2025-12-09T15:10:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"nvd":[{"id":"CVE-2025-67504","description":"WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.","status":"published","published":"2025-12-09T16:18:24.237Z","modified":"2026-10-07T20:10:01.97Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-331","CWE-338"],"updated_at":"2026-11-02T14:11:49.468427Z"}],"osv":[{"id":"CVE-2025-67504","title":"WBCE CMS has Weak Random Number Generator in Password Generation Function","description":"WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.","status":"published","published":"2025-12-09T03:31:17.723Z","modified":"2026-10-28T02:30:51.101935553Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-331","CWE-338"],"updated_at":"2026-11-02T15:44:52.53036Z"}]}}