{“lastseen”:”2025-10-30T15:16:11″,”description”:”WBCE………………………………………”,”published”:”2025-10-30T00:00:00″,”modified”:”2025-10-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WBCE CMS 1.6.4 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:211035″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: WBCE CMS 1.6.4 – Stored Cross-Site Scripting (XSS)\\n # Date: 2025-10-29\\n # Exploit Author: Chokri Hammedi\\n # Vendor Homepage: https:\/\/wbce.org\/\\n # Software Link: https:\/\/github.com\/WBCE\/WBCE_CMS\/releases\/tag\/v1.6.4\\n # Version: 1.6.4\\n # Tested on: Linux (Debian\/Parrot OS)\\n \\n \\n ## Vulnerability Description\\n WBCE CMS version 1.6.4 contains a stored Cross-Site Scripting (XSS)\\n vulnerability in the Droplets module. Authenticated attackers with\\n administrator privileges can inject and execute arbitrary JavaScript code.\\n \\n ## Proof of Concept\\n \\n 1. Log in to the WBCE admin panel with administrator credentials\\n 2. Navigate to \\”Admin-Tools\\” in the sidebar menu\\n 3. Click on \\”Droplets\\” to access the droplet management interface\\n 4. Click \\”Add droplet\\” to create a new droplet\\n 5. Enter a random name for the droplet and insert the following XSS payload\\n in the code area:\\n \\n \\n echo \\”\\u003cscript\\u003ealert(‘XSS Vulnerability Demonstrated – Session: ‘ +\\n document.cookie);\\u003c\/script\\u003e\\”;\\n \\n \\n \\n 6. Click \\”Save \\u0026 Back\\” to store the droplet\\n 7. Copy the droplet code name (e.g., `[[test]]`) from the droplets list.\\n You can find this under the description column by clicking the info icon.\\n 8. Edit or create any page and insert the droplet code name within double\\n brackets\\n 9. View the page to see the XSS payload execute automatically”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211035″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211035\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-30T15:16:11″,”description”:”WBCE………………………………………”,”published”:”2025-10-30T00:00:00″,”modified”:”2025-10-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WBCE CMS 1.6.4 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:211035″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: WBCE CMS 1.6.4 – Stored Cross-Site Scripting (XSS)\\n # Date: 2025-10-29\\n # Exploit Author: Chokri Hammedi\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-24077","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n