CVE-2025-59113: Windu CMS

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

Affected products

• Windu Windu CMS: version 4.1 only

Published 2025-11-18. Last modified 2026-06-17.