The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://cert.pl/posts/2025/11/CVE-2025-59110 |
|
| https://windu.org |
|
Tue, 18 Nov 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 18 Nov 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |
| Title | Broken Access Control in Windu CMS | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2025-11-18T15:32:08.259Z
Reserved: 2025-09-09T09:50:09.670Z
Link: CVE-2025-59111
Vulnrichment
Updated: 2025-11-18T15:32:03.173Z
NVD
Status : Received
Published: 2025-11-18T15:16:32.900
Modified: 2025-11-18T15:16:32.900
Link: CVE-2025-59111
Redhat
No data.
OpenCVE Enrichment
No data.