Jcd Windu Cms
11 CVEs affecting Jcd Windu Cms. Latest disclosed: 2026-07-20. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59113 | High | 7.5 | 2025-11-18 | Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the ser… |
CVE-2025-59114 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the… |
CVE-2025-59112 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the vi… |
CVE-2025-59111 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to dele… |
CVE-2025-59110 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token… |
CVE-2025-59115 | Medium | 5.4 | 2025-11-18 | Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitra… |
CVE-2025-59116 | Medium | 5.3 | 2025-11-18 | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login i… |
CVE-2025-59117 | Medium | 4.8 | 2025-11-18 | Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulne… |
CVE-2026-57311 | | 2026-07-20 | Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Executio… | |
CVE-2026-57310 | | 2026-07-20 | Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode use… | |
CVE-2026-57309 | | 2026-07-20 | A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP head… |