CVE-2026-112205mediumCWE-307

CVE-2026-112205: medium-severity vulnerability in Fundacja Widzialni WidzialniCMS

Bruteforce Protection Bypass in WidzialniCMS

Published

Follow this CVE+ Monitor WidzialniCMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9
WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in version 2.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
Fundacja Widzialni · WidzialniCMS
Related CVEs — Fundacja Widzialni WidzialniCMS

In the same product, most dangerous first.

CVE-2026-112204MEDIUMReflected XSS in WidzialniCMSEPSS —CVE-2026-110469CRITICALRemote Code Execution via Unrestricted File Upload in WidzialniCMSEPSS —CVE-2026-110468CRITICALRemote Code Execution via Unrestricted File Upload in WidzialniCMSEPSS —