CVE-2022-4006— WBCE CMS Header class.login.php increase_attempts excessive authentication
Quick assessment
Affected
WBCE CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WBCE CMS是一套基于PHP和MySQL的开源内容管理系统（CMS）。 WBCE CMS存在安全漏洞，该漏洞源于其Header Handler组件中wbce/framework/class.login.php文件的increase_attempts函数对X-Forwarded-For参数未适当地限制过多的身份验证尝试。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-4006
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WBCE CMS Header class.login.php increase_attempts excessive authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213716.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
WBCE CMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WBCE CMS是一套基于PHP和MySQL的开源内容管理系统（CMS）。 WBCE CMS存在安全漏洞，该漏洞源于其Header Handler组件中wbce/framework/class.login.php文件的increase_attempts函数对X-Forwarded-For参数未适当地限制过多的身份验证尝试。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-4006
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-4006
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-4006 (1)
Vendor Advisories for CVE-2022-4006 (1)
Other References for CVE-2022-4006 (1)
IV. Related Vulnerabilities
Same product: CMS
-
CVE-2026-105985
Authenticated RCE via render-components Entry Type overrides -
CVE-2026-92594
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via G -
CVE-2026-92593
Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Ex -
CVE-2026-92592
Craft CMS before 4.18.6 Remote Code Execution via signed coo -
CVE-2026-92590
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fiel
Same vendor: WBCE
-
CVE-2022-50936
WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated) -
CVE-2025-34506
WBCE CMS 1.6.3 Authenticated Remote Code Execution via Modul -
CVE-2024-58283
WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Uploa -
CVE-2025-65950
WBCE CMS is Vulnerable to Time-Based Blind SQL Injection thr -
CVE-2025-67504
WBCE CMS has Weak Random Number Generator in Password Genera
Same weakness: CWE-400
-
CVE-2026-108545
SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial -
CVE-2026-107840
yopass Prometheus metrics middleware allows remote memory ex -
CVE-2026-107839
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud -
CVE-2026-107834
OWASP Coraza WAF: Resource exhaustion via deferred file hand -
CVE-2026-107805
Nginx UI: Unauthenticated signed-request body staging can ex
V. Comments for CVE-2022-4006
No comments yet