Back to search
CVE-2025-59113
Published: Nov 18, 2025
Modified: Dec 5, 2025
PUBLISHED
Description
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
| Vendor | Product | Versions |
|---|---|---|
JCD | Windu CMS | affected 0 - <= 4.1 |
Weaknesses (CWE)
References
https://windu.org
product
https://cert.pl/posts/2025/11/CVE-2025-59110
third-party-advisory
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now