CVE-2025-59115
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data is not properly validated. A malicious attacker can inject arbitrary HTML and JS into the website, which will be rendered/executed when an administrator visits the logs page. Only version 4.1 was tested and confirmed vulnerable; the issue was fixed in version 4.1 build 2250.
Risk Assessment
An attacker could store malicious code that executes in the browser of an administrator viewing logs, potentially leading to session theft or unauthorized actions. This requires the ability to submit data on the logon page.
Recommendation
Update Windu CMS to version 4.1 build 2250 or later. Additionally, implement input validation and encoding on the logon page and consider deploying a Content Security Policy.
Other vulnerabilities in Windu CMS
See all- CVE-2026-57309Critical
A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.
- CVE-2026-57311Medium
Windu CMS does not validate uploaded file types, allowing an authenticated attacker to upload arbitrary files, including PHP. This can lead to Remote Code Execution (RCE). Confirmed in version 4.1, but other versions may be affected.
- CVE-2026-57310Medium
Windu CMS uses hashing algorithms based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtains a password hash to decode user credentials. The vulnerability has been confirmed in version 4.1 but may affect other versions.
- CVE-2025-59117Medium
Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. Only version 4.1 was tested and confirmed as vulnerable; this issue was fixed in version 4.1 build 2250.
- CVE-2025-59116Medium
Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
- CVE-2025-59114Medium
Windu CMS is vulnerable to Cross-Site Request Forgery in the file uploading functionality. A malicious attacker can craft a special website that, when visited by the victim, automatically sends a malicious file to the server.
- CVE-2025-59113High
Windu CMS implements weak client-side brute-force protection using the loginError parameter; attempt count and timeout are not stored server-side, allowing attackers to bypass protection by resetting the parameter. Version 4.1 was confirmed vulnerable; fixed in 4.1 build 2250.
- CVE-2025-59112Medium
Windu CMS is vulnerable to Cross-Site Request Forgery in the user editing functionality. A malicious attacker can craft a special website that, when visited by the victim, automatically sends a POST request that deletes a given user.
- CVE-2025-59111Medium
Windu CMS version 4.1 is vulnerable to Broken Access Control in the user editing functionality. A malicious attacker can send a GET request that allows privileged users to delete Super Admins, which is not possible through the GUI. The issue was fixed in version 4.1 build 2250.
- CVE-2025-59110Medium
Windu CMS is vulnerable to Cross-Site Request Forgery in its user editing functionality. The CSRF protection mechanism can be bypassed by using another user's CSRF token, and registration is open so anyone can create an account. Only version 4.1 was tested and confirmed vulnerable; the issue was fixed in version 4.1 build 2250.
Original NVD description (English source)
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting logs page by admin. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS