Windu CMS stores user passwords by hashing with MD5 and SHA1 combined with a static salt. This insecure scheme allows an attacker who obtains a password hash to recover the original credentials through offline cracking. The weakness is captured by CWE-916, meaning the hashing does not provide the intended security guarantees. The consequence is that compromised passwords grant full access to the affected accounts and potentially the underlying system.

The vulnerability is confirmed for Windu CMS version 4.1 and may also affect earlier releases. The product is developed by JCD under the Windu CMS project. No other vendors or unrelated products are listed as affected.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, and the issue is not listed in CISA KEV, suggesting no known large‑scale exploitation yet. The most likely attack path is an offline attack: an adversary who gains access to the database or otherwise extracts password hashes can leverage the weak algorithm to recover user passwords quickly. While the attack requires prior compromise or data disclosure, the impact on confidentiality, integrity, and availability can be significant once credentials are retrieved.