Windu CMS stores user passwords by hashing with MD5 and SHA1 combined with a static salt. This insecure scheme allows an attacker who obtains a password hash to recover the original credentials through offline cracking. The weakness is captured by CWE‑916, meaning the hashing does not provide the intended security guarantees. The consequence is that compromised passwords grant full access to the affected accounts and potentially the underlying score of 6.3 indicates moderate severity. The most likely attack path is an offline attack: an adversary who gains access to the database or otherwise extracts password hashes can leverage the weak algorithm to recover user passwords quickly. While the attack requires prior compromise or data disclosure, the impact on confidentiality, integrity, and availability can be significant once credentials are retrieved.

The vulnerability is confirmed for Windu CMS version 4.1 developed by JCD. While the official advisory only verifies this version, the hashing weakness could potentially impact earlier or later releases that use the same legacy password storage scheme, so all installations of Windu CMS using the MD5/SHA1 hashing with static salt should be reviewed.

With a CVSS score of 6.3, the vulnerability is classified as moderate severity. The EPSS score of < 1% indicates that the likelihood of exploitation is low, and the vulnerability is not listed in CISA KEV, meaning no large‑scale exploitation has been reported. Attackers typically need to obtain the stored password hashes, for example through a database dump or another channel that allows extraction of the hash file. Because the hashing algorithm uses a static salt combined with weak primitives, the offline cracking effort is relatively small, enabling attackers to recover clear‑text passwords quickly. Once obtained, those credentials can be used to take full control of the affected accounts, which may include administrative privileges, compromising the confidentiality, integrity, and availability of the CMS.