CVE-2025-59113

Katalog CVE

CVSS 7.5 · High EPSS 0,28%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada windu cms. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

Rincian

Terbit di NVD

18 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.pl/posts/2025/11/CVE-2025-59110 advisory pihak ketiga
• https://windu.org product