PT-2025-47308 · Windu Cms · Windu Cms

Karol Czubernat · Published 2025-11-18 · Updated 2025-12-05 · CVE-2025-59110

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Windu CMS version 4.1 Windu CMS (affected versions not specified)

Description Windu CMS has a flaw that allows attackers to perform Cross-Site Request Forgery (CSRF) attacks in the user editing functionality. The existing CSRF protection can be circumvented by utilizing the CSRF token from another user. Registration is open to anyone, allowing for easy account creation.

Recommendations Apply a fix for Windu CMS version 4.1. Implement a robust CSRF protection mechanism that prevents the use of CSRF tokens from other users.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-59110

Affected Products

Windu Cms

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2025-59110 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59110 · Vendor Advisory
• https://t.me/cveNotify/144865 · Telegram Post
• https://t.me/cveNotify/144863 · Telegram Post
• https://t.me/cveNotify/143453 · Telegram Post
• https://t.me/cveNotify/143454 · Telegram Post
• https://t.me/cveNotify/144870 · Telegram Post
• https://twitter.com/CVEnew/status/1990786249003516188 · Twitter Post
• https://t.me/cveNotify/144869 · Telegram Post
• https://t.me/cveNotify/144868 · Telegram Post
• https://t.me/CVEtracker/37619 · Telegram Post
• https://t.me/cveNotify/144866 · Telegram Post
• https://windu.org · Note
• https://t.me/cveNotify/143455 · Telegram Post
• https://t.me/cveNotify/144864 · Telegram Post