Which versions of Windu Cms are affected by CVE-2026-57309?

Windu CMS 4.1 contains a blind SQL injection vulnerability accessible via unauthenticated network requests, exposing the underlying database to direct query manipulation.

How to fix or mitigate CVE-2026-57309?

Within 24 hours: inventory all systems running Windu CMS 4.1 and assess network accessibility; deploy Web Application Firewall rules to block SQL injection patterns in HTTP headers and URL paths targeting the CMS; restrict direct network access to CMS instances via firewall policy if operationally feasible. Within 7 days: enable comprehensive HTTP request and database query logging on all CMS instances; set up alerting for suspicious SQL syntax in logs; validate WAF rule effectiveness through controlled testing. Within 30 days: evaluate platform migration to an alternative CMS or obtain formal vendor commitment on patched version availability; implement database account permissions restricting query scope and result sets; establish 24/7 database activity monitoring to detect potential breaches.

Windu Cms CVE-2026-57309

Q: What is the CVSS score of CVE-2026-57309?

CVE-2026-57309 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45943 CRITICAL

SQL Injection (CWE-89)

2026-07-20 CERT-PL

GHSA-m6xq-wg6p-prq3

SQLi Windu Cms Jcd

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CERT-PL) · only source for this CVE.

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 13:21 vuln.today

CVE Published

Jul 20, 2026 - 12:52 cve.org

CRITICAL 9.3

DescriptionCVE.org

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

AnalysisAI

Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP header, requiring no authentication per the PR:N vector. Because the vendor (jcd) never responded to CERT-PL disclosure, only version 4.1 is confirmed vulnerable while other releases may also be affected. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the unauthenticated network-facing nature and CWE-89 root cause make it a high-severity data-exposure risk.