CVE-2026-57309
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.
Risk Assessment
An attacker can extract database contents, including sensitive user data, without authentication, posing a serious threat to data confidentiality and integrity.
Recommendation
Contact the vendor for a patch or consider migrating to another CMS if unresponsive. Temporarily restrict access to the application via firewall.
Other vulnerabilities in Windu CMS
See all- CVE-2026-57311Medium
Windu CMS does not validate uploaded file types, allowing an authenticated attacker to upload arbitrary files, including PHP. This can lead to Remote Code Execution (RCE). Confirmed in version 4.1, but other versions may be affected.
- CVE-2026-57310Medium
Windu CMS uses hashing algorithms based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtains a password hash to decode user credentials. The vulnerability has been confirmed in version 4.1 but may affect other versions.
Original NVD description (English source)
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.