PT-2025-47314 · Windu Cms · Windu Cms

Karol Czubernat · Published 2025-11-18 · Updated 2025-12-05 · CVE-2025-59116

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Windu CMS version 4.1 Windu CMS (affected versions not specified)

Description Windu CMS is susceptible to User Enumeration. During the login process, differing messages can reveal whether a login attempt is valid, potentially enabling a brute force attack utilizing valid credentials. The vendor was informed of this issue but did not provide details regarding vulnerable versions. Testing confirmed version 4.1 as vulnerable, and other versions may also be affected.

Recommendations Versions prior to version 4.1 should be considered vulnerable and investigated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-59116

Affected Products

Windu Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-59116 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59116 · Vendor Advisory
• https://t.me/CVEtracker/37626 · Telegram Post
• https://twitter.com/CVEnew/status/1990786242435280921 · Twitter Post
• https://cert.pl/posts/2025/11/CVE-2025-59110 · Note
• https://t.me/cveNotify/144869 · Telegram Post
• https://windu.org · Note