CVE-2025-59110

MEDIUM

Windu CMS 4.1 - Cross-Site Request Forgery via Token Bypass

Title source: llm

Description

Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

References (2)

Core 2

Core References

Product product

https://windu.org/

Third Party Advisory third-party-advisory

https://cert.pl/posts/2025/11/CVE-2025-59110

Scores

CVSS v3 6.5

EPSS 0.0015

EPSS Percentile 4.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (1)

windu/windu_cms 4.1

Published Nov 18, 2025

Tracked Since Feb 18, 2026