Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.
Only version 4.1 was tested and confirmed as vulnerable.
This issue was fixed in version 4.1 build 2250.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Windu |
|
No data.
References
| Link | Providers |
|---|---|
| https://cert.pl/posts/2025/11/CVE-2025-59110 |
|
| https://windu.org |
|
History
Fri, 05 Dec 2025 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250. |
Thu, 20 Nov 2025 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:windu:windu_cms:4.1:*:*:*:*:*:*:* | |
| Metrics |
cvssV3_1
|
Wed, 19 Nov 2025 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Windu
Windu windu Cms |
|
| Vendors & Products |
Windu
Windu windu Cms |
Tue, 18 Nov 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 18 Nov 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |
| Title | User enumeration in Windu CMS | |
| Weaknesses | CWE-204 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published: 2025-11-18T13:26:56.775Z
Updated: 2025-12-05T12:21:56.289Z
Reserved: 2025-09-09T09:50:09.670Z
Link: CVE-2025-59116
Vulnrichment
Updated: 2025-11-18T15:02:20.662Z
NVD
Status : Modified
Published: 2025-11-18T15:16:34.127
Modified: 2025-12-05T13:16:04.333
Link: CVE-2025-59116
Redhat
No data.