CVE-2025-66204

HighCVSS 8.1/10Last modified Oct 7, 2026

Description

WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307 CWE-693

Affected software

Vendor	Product	Versions
WBCE	WBCE_CMS	>= 1.6.4, < 1.6.5

References

https://github.com/WBCE/WBCE_CMS/commit/3765baddf27f31bbbea9c0228c452268621b25e5Patch
https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5Release Notes
https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mwExploit, Vendor Advisory
https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-f676-f375-m7mwExploit, Vendor Advisory

Timeline

Published: Dec 9, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-662059.8Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injecti CVE-2025-662068.6Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, CVE-2025-662089.8Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabor CVE-2025-662098.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-66219.8A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.CVE-2025-662108.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-662118.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-662128.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-662138.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an auth CVE-2025-662148.8Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 conta CVE-2025-662156.8OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the t CVE-2025-662169.8AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Me