PT-2026-61587 · Jcd · Windu Cms

Jakub Lipiński + 2 · CVE-2026-57309 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-57309

Produtos afetados

Windu Cms

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-57309 · Nota de Segurança
• https://windu.org · Nota
• https://cert.pl/posts/2026/07/CVE-2026-57309 · Nota