The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://cert.pl/posts/2025/11/CVE-2025-59110 |
|
| https://windu.org |
|
Tue, 18 Nov 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 18 Nov 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |
| Title | Bruteforce Protection Bypass in Windu CMS | |
| Weaknesses | CWE-307 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2025-11-18T17:13:06.755Z
Reserved: 2025-09-09T09:50:09.670Z
Link: CVE-2025-59113
Vulnrichment
Updated: 2025-11-18T17:11:23.549Z
NVD
Status : Received
Published: 2025-11-18T15:16:33.387
Modified: 2025-11-18T15:16:33.387
Link: CVE-2025-59113
Redhat
No data.
OpenCVE Enrichment
No data.