The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://cert.pl/posts/2025/11/CVE-2025-59110 |
|
| https://windu.org |
|
Tue, 18 Nov 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 18 Nov 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |
| Title | User enumeration in Windu CMS | |
| Weaknesses | CWE-204 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2025-11-18T15:13:05.365Z
Reserved: 2025-09-09T09:50:09.670Z
Link: CVE-2025-59116
Vulnrichment
Updated: 2025-11-18T15:02:20.662Z
NVD
Status : Received
Published: 2025-11-18T15:16:34.127
Modified: 2025-11-18T15:16:34.127
Link: CVE-2025-59116
Redhat
No data.
OpenCVE Enrichment
No data.