CVE-2024-58283

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-582847.2PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP co CVE-2024-582855.4Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post title CVE-2024-582869.3dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executab CVE-2024-582878.8reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated at CVE-2024-582888.7Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Atta CVE-2024-582895.4Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into CVE-2024-58293.5A vulnerability classified as problematic was found in smallweigit Avue up to 3.4.4. Affected by this vulnerability is an unknown functional CVE-2024-582909.3Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate datab CVE-2024-582915.3Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in f CVE-2024-582925.3XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious Ja CVE-2024-582938.6Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template express CVE-2024-582948.8FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credenti