CVE-2025-59113 — Bruteforce Protection Bypass in Windu CMS
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows …
Published: 2025-11-18 · CVSS: 6.9 · CVSS 4.0
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7