CVE-2025-59116CWE-204

CVE-2025-59116

Medium · published November 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.

Only version 4.1 was tested and confirmed as vulnerable.

This issue was fixed in version 4.1 build 2250.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-11-18T20:16Z
Affected products (1)
ProductVersionsFixed in
windu/windu_cmsall versions—
References (2)
https://cert.pl/posts/2025/11/CVE-2025-59110 · [email protected]https://windu.org · [email protected]
EPSS history
Timeline
  • 18 NOV 13:26Z
    User enumeration in Windu CMS
    cvelistv5