Stored Cross-Site Scripting Vulnerability in Windu CMS
CVE-2025-59117

4.8MEDIUM

Key Information:

Vendor

Jcd

Status
Windu Cms
Vendor
CVE Published:
18 November 2025

What is CVE-2025-59117?

Windu CMS contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities within the page editing endpoint at windu/admin/content/pages/edit/. Exploitation of these vulnerabilities can allow a privileged user to execute malicious scripts in the context of another user's session. The vendor was informed about the issue but did not disclose details concerning the scope of the vulnerability or the range of affected versions. So far, only version 4.1 has been tested and confirmed to be vulnerable, raising concerns that other versions may also be susceptible.

Affected Version(s)

Windu CMS 4.1

References

https://windu.org
product
https://cert.pl/posts/2025/11/CVE-2025-59110
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karol Czubernat
JSON
.
CVE-2025-59117 : Stored Cross-Site Scripting Vulnerability in Windu CMS