The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://cert.pl/posts/2025/11/CVE-2025-59110 |
|
| https://windu.org |
|
Tue, 18 Nov 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 18 Nov 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send malicious file to the server. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |
| Title | Cross-Site Request Forgery in Windu CMS | |
| Weaknesses | CWE-352 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2025-11-18T16:59:27.031Z
Reserved: 2025-09-09T09:50:09.670Z
Link: CVE-2025-59114
Vulnrichment
Updated: 2025-11-18T16:55:03.619Z
NVD
Status : Received
Published: 2025-11-18T15:16:33.717
Modified: 2025-11-18T15:16:33.717
Link: CVE-2025-59114
Redhat
No data.
OpenCVE Enrichment
No data.