CVE-2026-57310
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Windu CMS uses hashing algorithms based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtains a password hash to decode user credentials. The vulnerability has been confirmed in version 4.1 but may affect other versions.
Risk Assessment
An attacker can recover user passwords, leading to account takeover and unauthorized system access.
Recommendation
Change the password storage mechanism to a strong hashing algorithm with random salt (e.g., bcrypt, Argon2).
Other vulnerabilities in Windu CMS
See all- CVE-2026-57309Critical
A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.
- CVE-2026-57311Medium
Windu CMS does not validate uploaded file types, allowing an authenticated attacker to upload arbitrary files, including PHP. This can lead to Remote Code Execution (RCE). Confirmed in version 4.1, but other versions may be affected.
Original NVD description (English source)
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.