CVE-2025-59115: Windu CMS

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting logs page by admin. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

Affected products

• Windu Windu CMS: version 4.1 only

Published 2025-11-18. Last modified 2026-06-17.