CVE-2026-57310CWE-916

Weak password hashing in Windu CMS

Medium · published July 20, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-916 · Use of Password Hash With Insufficient Computational Effort
Published
2026-07-20T12:52Z
EPSS history
Timeline
  • 20 JUL 12:52Z
    Weak password hashing in Windu CMS
    cvelistv5