EUVD-2026-45944
GHSA-m7pv-37vf-wpvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the mandatory prerequisite of obtaining password hashes before exploitation; confidentiality impact is low since only stored credentials are recoverable, not the system itself.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
AnalysisAI
Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.
Technical ContextAI
CWE-916 (Use of Password Hash With Insufficient Computational Effort) describes the root cause precisely: Windu CMS employs MD5 and SHA1 as its password hashing primitives, both of which are cryptographic hash functions optimized for speed, not for resisting brute-force or dictionary attacks. The use of a static salt - shared across all password records - means an attacker can precompute a single rainbow table covering the entire user base, eliminating per-hash cracking overhead. Modern password hashing standards (bcrypt, scrypt, Argon2id, PBKDF2) use high work factors and unique per-record salts to make offline cracking computationally prohibitive. The affected product is identified by CPE cpe:2.3:a:jcd:windu_cms:*:*:*:*:*:*:*:* (vendor: jcd), indicating the wildcard spans all versions in the NVD dataset, though only version 4.1 is independently confirmed by CERT-PL. The CVSS 4.0 vector AV:N/AC:L/AT:P reflects that network reachability applies to the application but a non-trivial prerequisite (AT:P) - acquiring the hash store - must be satisfied before exploitation of this specific weakness.
RemediationAI
No vendor-released patch has been identified at time of analysis - vendor contact attempts by CERT-PL were unsuccessful, leaving no confirmed fix version. As a primary compensating control, administrators should migrate password storage to a strong adaptive hashing algorithm (Argon2id is the current OWASP recommendation, with bcrypt or scrypt as alternatives); this requires a code-level change to the authentication module and a forced password reset for all users, since existing MD5/SHA1 hashes cannot be retroactively re-hashed without user re-authentication. If a database exposure is suspected or confirmed, immediately force a site-wide password reset and notify affected users, as the existing hashes should be treated as compromised. Restrict database access to application-layer only and audit SQL query patterns for injection vectors to reduce the likelihood of hash exfiltration. Monitor the CERT-PL advisory at https://cert.pl/posts/2026/07/CVE-2026-57309 and the vendor site at https://windu.org for any future patch release.
Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP hea
Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP
Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu
Windu CMS is vulnerable to User Enumeration. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitabl
Windu CMS is vulnerable to Stored Cross-Site Scripting (XSS) in the logon page where input data has no proper validation
Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Rated medium severity (CVSS 5.1),
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Rated medium severity (CVSS
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Rated medium severity (CVSS 5.1), t
Windu CMS is vulnerable to Broken Access Control in user editing functionality. Rated medium severity (CVSS 6.9), this v
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Rated medium severity (CVSS 6.8), t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today