Windu Cms
Vendor:
First CVE: Aug 1, 2019 · Active for 6 years
10
Total CVEs
More Total CVEs than 88% of tracked products
5.0
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
6.4
Avg CVSS
Higher Avg CVSS than 27% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Windu Cms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 1, 2019
6 years ago
Most Recent CVE
Nov 18, 2025
248 days ago
CVE Severity & Scoring
Windu Cms10 CVEs
80%
20%
All CVEs352,294 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network10 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (30.0%)
Unknown0 (0.0%)
Required7 (70.0%)
Privileges Required
Low1 (10.0%)
High2 (20.0%)
None7 (70.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-7473HIGH Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. | Aug 1, 2019 | 8.8 | 27 | NO | NO |
CVE-2025-59113HIGH Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a m | Nov 18, 2025 | 7.5 | 24 | NO | NO |
CVE-2025-59111MEDIUM Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which | Nov 18, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-59114MEDIUM Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automati | Nov 18, 2025 | 6.5 | 21 | NO | NO |
CVE-2025-59112MEDIUM Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Malicious attacker can craft special website, which when visited by the victim, will automatica | Nov 18, 2025 | 6.5 | 21 | NO | NO |
CVE-2025-59110MEDIUM Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is | Nov 18, 2025 | 6.5 | 21 | NO | NO |
CVE-2013-7474MEDIUM Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. | Aug 1, 2019 | 6.1 | 21 | NO | NO |
CVE-2025-59116MEDIUM Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabl | Nov 18, 2025 | 5.3 | 19 | NO | NO |
CVE-2025-59115MEDIUM Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into w | Nov 18, 2025 | 5.4 | 19 | NO | NO |
CVE-2025-59117MEDIUM Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/.
This vulnerability can be explo | Nov 18, 2025 | 4.8 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Windu Cms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.1 | 8 | 6.1 | 0.2% | 0 | 0 |
| 2.2 | 2 | 7.5 | 0.7% | 0 | 0 |