Windu Windu_cms
10 CVEs affecting Windu Windu_cms. Latest disclosed: 2025-11-18. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-7473 | High | 8.8 | 2019-08-01 | Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. |
CVE-2025-59113 | High | 7.5 | 2025-11-18 | Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the ser… |
CVE-2025-59114 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the… |
CVE-2025-59112 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the vi… |
CVE-2025-59111 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to dele… |
CVE-2025-59110 | Medium | 6.5 | 2025-11-18 | Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token… |
CVE-2013-7474 | Medium | 6.1 | 2019-08-01 | Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. |
CVE-2025-59115 | Medium | 5.4 | 2025-11-18 | Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitra… |
CVE-2025-59116 | Medium | 5.3 | 2025-11-18 | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login i… |
CVE-2025-59117 | Medium | 4.8 | 2025-11-18 | Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulne… |