Weak Client-Side Brute-Force Protection in Windu CMS

CVE-2025-59113

What is CVE-2025-59113?

Windu CMS suffers from a significant security issue due to its flawed client-side brute-force protection mechanism. The application relies on the 'loginError' parameter for managing login attempts, without server-side tracking of these attempts. This allows attackers to exploit the system by resetting the parameter to bypass the protective measures in place. Although the vendor was informed of the issue, only version 4.1 has been confirmed vulnerable, leaving the status of other versions uncertain. This vulnerability poses a risk to users, as it makes unauthorized access to accounts much easier for malicious actors.

References