Description
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
Published: 2026-07-20
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A blind SQL injection flaw exists in Windu CMS that allows a remote attacker to insert SQL syntax into the URL path portion of an HTTP header. The vulnerability is exploitable without any authentication, meaning an attacker can access the underlying database and retrieve data.

Affected Systems

The issue has been confirmed in Windu CMS version 4.1; other releases may also be affected, but this is not yet verified.

Risk and Exploitability

The CVSS score of 9.3 classifies this as a critical flaw, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could use blind SQL injection to infer and exfiltrate sensitive data from the database by manipulating the HTTP header. No administrative privileges are required for the attack.

Generated by OpenCVE AI on July 30, 2026 at 19:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch or upgrade to a non‑vulnerable version of Windu CMS
  • Configure a Web Application Firewall or reverse proxy to reject or sanitize any HTTP headers containing URL‑derived path data
  • Modify the application code to use parameterized SQL queries for all URL‑derived input

Generated by OpenCVE AI on July 30, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Jcd
Jcd windu Cms
Vendors & Products Jcd
Jcd windu Cms

Mon, 20 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
Description A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
Title Blind SQL Injection in Windu CMS
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Jcd Windu Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-20T15:41:44.857Z

Reserved: 2026-06-24T12:12:42.195Z

Link: CVE-2026-57309

cve-icon Vulnrichment

Updated: 2026-07-20T15:41:30.385Z

cve-icon NVD

Status : Deferred

Published: 2026-07-20T13:16:56.367

Modified: 2026-07-22T20:53:19.510

Link: CVE-2026-57309

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:30:09Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')