Windu is a content management system vendor with a focused product portfolio centered on its Windu CMS platform. The vendor's vulnerability surface reflects characteristic weaknesses of web applications, including cross-site request forgery, cross-site scripting, improper authentication-attempt controls, authorization flaws, and observable response discrepancies that can leak sensitive state information. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Windu over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-7473HIGH Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. | Aug 1, 2019 | 8.8 | 27 | NO | NO |
CVE-2025-59113HIGH Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a m | Nov 18, 2025 | 7.5 | 24 | NO | NO |
CVE-2025-59111MEDIUM Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which | Nov 18, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-59114MEDIUM Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automati | Nov 18, 2025 | 6.5 | 21 | NO | NO |
CVE-2025-59112MEDIUM Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the victim, will automatica | Nov 18, 2025 | 6.5 | 21 | NO | NO |
CVE-2025-59110MEDIUM Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is | Nov 18, 2025 | 6.5 | 21 | NO | NO |
CVE-2013-7474MEDIUM Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. | Aug 1, 2019 | 6.1 | 21 | NO | NO |
CVE-2025-59116MEDIUM Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabl | Nov 18, 2025 | 5.3 | 19 | NO | NO |
CVE-2025-59115MEDIUM Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into w | Nov 18, 2025 | 5.4 | 19 | NO | NO |
CVE-2025-59117MEDIUM Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/.
This vulnerability can be explo | Nov 18, 2025 | 4.8 | 18 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Windu.
Media articles that mention a CVE ID that affects a product developed by Windu — matched by CVE ID, not by vendor name.